{"record":{"id":"1da0425ce8c78cd4","repo":"dgraph-io/dgraph","slug":"s-verification-failed","errorCode":null,"errorMessage":"%s: verification failed","messagePattern":"(.+?): verification failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"dgraph/cmd/cert/cert.go","lineNumber":171,"sourceCode":"\troots.AddCert(c.parent)\n\topts := x509.VerifyOptions{Roots: roots}\n\n\tif c.hosts != nil {\n\t\topts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth,\n\t\t\tx509.ExtKeyUsageClientAuth}\n\t\tfor i := range c.hosts {\n\t\t\tif err := cert.VerifyHostname(c.hosts[i]); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t}\n\tif c.client != \"\" {\n\t\topts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}\n\t}\n\n\t_, err = cert.Verify(opts)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"%s: verification failed\", certFile)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":153,"sourceCodeEnd":176,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/dgraph/cmd/cert/cert.go#L153-L176","documentation":"verifyCert (dgraph/cmd/cert/cert.go:171) wraps the error returned by x509.Certificate.Verify when the freshly created node or client cert fails chain verification against its parent CA (Roots pool built from c.parent). The wrapped err from the stdlib explains the actual cause: expired, unknown authority, wrong key usage, hostname mismatch, etc. It is returned right after cert creation, so it means the new cert is not usable.","triggerScenarios":"createNodePair or createClientPair generates a cert and then calls verifyCert; cert.Verify fails because the CA expired, the CA cert is not the actual signer, the cert's KeyUsages don't match the requested ExtKeyUsage (ServerAuth/ClientAuth), or the chain is otherwise untrusted (e.g. mismatched ca.crt/key or corrupted files).","commonSituations":"ca.crt was regenerated after the node/client cert, so the signer no longer matches; mixing files from different --force regenerations; system clock skew making certs not-yet-valid or expired; manually edited/re-issued certs with mismatched key usage.","solutions":["Read the wrapped x509 error to identify the cause (UnknownAuthority, Expired, IncompatibleKeyUsage).","Regenerate the full chain together: `dgraph cert --ca --force` then `dgraph cert --node --client --force` so parent and leaves match.","Verify the files are a matching pair with `dgraph cert --info` or `openssl verify -CAfile ca.crt node.crt`.","Check clock/NotBefore skew if the error is 'certificate is not valid yet'."],"exampleFix":"# before: mixing an old CA with new node certs\ndgraph cert --node --force\n# after: regenerate CA and leaves together\ndgraph cert --ca --node --client --force","handlingStrategy":"try-catch","validationCode":"// Pre-verify chain outside the tool before trusting the generated cert\nroots := x509.NewCertPool()\nca, _ := readCert(\"ca.crt\")\nroots.AddCert(ca)\ncert, err := readCert(\"node.crt\")\nif err == nil {\n    if _, err := cert.Verify(x509.VerifyOptions{Roots: roots}); err != nil {\n        fmt.Println(\"chain invalid:\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := verifyCert(\"node.crt\"); err != nil {\n    var inner error\n    if unwrapped, ok := err.(*errors.Error); ok && errors.Is(err, x509.CertificateInvalidError{}) {\n        inner = unwrapped.Unwrap()\n    }\n    // inspect inner: UnknownAuthority/Expired/IncompatibleKeyUsage\n    return fmt.Errorf(\"regenerate chain: %w\", err)\n}","preventionTips":["Regenerate CA and leaf certs together with --force so parent/signer always match.","Never mix cert files from separate generation runs in the same tls directory.","Keep NTP/clock sync enabled on hosts issuing and verifying certs.","Verify with `openssl verify -CAfile ca.crt node.crt` after generation."],"tags":["x509","certificate-verification","tls","pki"],"backgroundTag":"x509-certificate-verification-failed","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}