{"record":{"id":"0f9bf14f9775cb37","repo":"coollabsio/coolify","slug":"failed-to-export-private-key-openssl-error-strin","errorCode":null,"errorMessage":"Failed to export private key: {openssl_error_string()}","messagePattern":"Failed to export private key: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":46,"sourceCode":"        ?string $mountPath = null,\n        bool $isPemKeyFileRequired = false,\n    ): SslCertificate {\n        $organizationName = self::DEFAULT_ORGANIZATION_NAME;\n        $countryName = self::DEFAULT_COUNTRY_NAME;\n        $stateName = self::DEFAULT_STATE_NAME;\n\n        try {\n            $privateKey = openssl_pkey_new([\n                'private_key_type' => OPENSSL_KEYTYPE_EC,\n                'curve_name' => 'secp521r1',\n            ]);\n\n            if ($privateKey === false) {\n                throw new \\RuntimeException('Failed to generate private key: '.openssl_error_string());\n            }\n\n            if (! openssl_pkey_export($privateKey, $privateKeyStr)) {\n                throw new \\RuntimeException('Failed to export private key: '.openssl_error_string());\n            }\n\n            if (! is_null($serverId) && ! $isCaCertificate) {\n                $server = Server::find($serverId);\n                if ($server) {\n                    $ip = $server->getIp;\n                    if ($ip) {\n                        $type = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6)\n                            ? 'IP'\n                            : 'DNS';\n                        $subjectAlternativeNames = array_unique(\n                            array_merge($subjectAlternativeNames, [\"$type:$ip\"])\n                        );\n                    }\n                }\n            }\n\n            $basicConstraints = $isCaCertificate ? 'critical, CA:TRUE, pathlen:0' : 'critical, CA:FALSE';","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L28-L64","documentation":"openssl_pkey_export() failed to serialize the freshly generated EC key to PEM. Key export in PHP requires a loadable OpenSSL configuration file; a missing or unreadable openssl.cnf (unset OPENSSL_CONF, wrong default path, container image without the file) is the classic cause even though key creation itself succeeded.","triggerScenarios":"Running SslHelper::generateSslCertificate() in environments where openssl_pkey_new succeeds but the OpenSSL config needed by export routines is absent — most commonly minimal Docker/Alpine PHP images or hosts with a broken OPENSSL_CONF.","commonSituations":"Custom Docker images that delete /etc/ssl/openssl.cnf to save space; OPENSSL_CONF pointing at a mounted file that disappeared; Windows PHP builds with a wrong openssl.cnf path in php.ini.","solutions":["Check php -i | grep openssl.cnf and make sure the shown file exists and is readable.","Set OPENSSL_CONF to a valid config (e.g. /etc/ssl/openssl.cnf) or install the openssl package in your image.","Persist a minimal openssl.cnf into the container and point the env var at it."],"exampleFix":"# before: export fails inside the container with 'Failed to export private key'\nFROM php:8.3-cli\n\n# after: ship a usable OpenSSL config\nFROM php:8.3-cli\nRUN apt-get update && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*\nENV OPENSSL_CONF=/etc/ssl/openssl.cnf","handlingStrategy":"try-catch","validationCode":"// Probe export capability (it depends on the OpenSSL config file)\n$key = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_EC, 'curve_name' => 'secp521r1']);\nif ($key === false || ! openssl_pkey_export($key, $pem)) {\n    throw new RuntimeException('OpenSSL cannot export keys (openssl.cnf missing?): '.openssl_error_string());\n}","typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName);\n} catch (\\RuntimeException $e) {\n    if (str_starts_with($e->getMessage(), 'Failed to export private key')) {\n        // config-file problem in the runtime: fix env, not code\n        report('openssl.cnf problem: '.$e->getMessage());\n        return null;\n    }\n    throw $e;\n}","preventionTips":["Never strip /etc/ssl/openssl.cnf from PHP images; export routines need it.","Set and verify OPENSSL_CONF in container orchestration (Dockerfile ENV, K8s env).","Include a certificate-generation smoke test in CI for the production image."],"tags":["ssl","openssl","key-export","php"],"backgroundTag":"openssl-key-export-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}