{"record":{"id":"0e31ba4460810b37","repo":"caddyserver/caddy","slug":"generating-stek-v","errorCode":null,"errorMessage":"generating STEK: %v","messagePattern":"generating STEK: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/sessiontickets.go","lineNumber":193,"sourceCode":"// removes the internal stored reference to cfg. If\n// session tickets are disabled or if ticket key rotation\n// is disabled, this function is a no-op.\nfunc (s *SessionTicketService) unregister(cfg *tls.Config) {\n\tif s.Disabled || s.DisableRotation {\n\t\treturn\n\t}\n\ts.mu.Lock()\n\tdelete(s.configs, cfg)\n\ts.mu.Unlock()\n}\n\n// RotateSTEKs rotates the keys in keys by producing a new key and eliding\n// the oldest one. The new slice of keys is returned.\nfunc (s SessionTicketService) RotateSTEKs(keys [][32]byte) ([][32]byte, error) {\n\t// produce a new key\n\tnewKey, err := s.generateSTEK()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generating STEK: %v\", err)\n\t}\n\n\t// we need to prepend this new key to the list of\n\t// keys so that it is preferred, but we need to be\n\t// careful that we do not grow the slice larger\n\t// than MaxKeys, otherwise we'll be storing one\n\t// more key in memory than we expect; so be sure\n\t// that the slice does not grow beyond the limit\n\t// even for a brief period of time, since there's\n\t// no guarantee when that extra allocation will\n\t// be overwritten; this is why we first trim the\n\t// length to one less the max, THEN prepend the\n\t// new key\n\tif len(keys) >= s.MaxKeys {\n\t\tkeys[len(keys)-1] = [32]byte{} // zero-out memory of oldest key\n\t\tkeys = keys[:s.MaxKeys-1]      // trim length of slice\n\t}\n\tkeys = append([][32]byte{newKey}, keys...) // prepend new key","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/sessiontickets.go#L175-L211","documentation":"Error \"generating STEK: %v\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddytls/sessiontickets.go:193 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the wrapped error; this usually indicates a crypto/RNG failure on the host."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}