{"record":{"id":"211a5347dcc1320c","repo":"caddyserver/caddy","slug":"generating-new-certificate-v","errorCode":null,"errorMessage":"generating new certificate: %v","messagePattern":"generating new certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/maintain.go","lineNumber":91,"sourceCode":"\t\t\t\tzap.Duration(\"time_remaining\", time.Until(ca.interChain[0].NotAfter)),\n\t\t\t)\n\t\t}\n\t}\n\n\t// only maintain the intermediate if it's not manually provided in the config\n\tif ca.Intermediate == nil {\n\t\tif ca.needsRenewal(ca.interChain[0]) {\n\t\t\tlog.Info(\"intermediate expires soon; renewing\",\n\t\t\t\tzap.Duration(\"time_remaining\", time.Until(ca.interChain[0].NotAfter)),\n\t\t\t)\n\n\t\t\trootCert, rootKey, err := ca.loadOrGenRoot()\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"loading root key: %v\", err)\n\t\t\t}\n\t\t\tinterCert, interKey, err := ca.genIntermediate(rootCert, rootKey)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"generating new certificate: %v\", err)\n\t\t\t}\n\t\t\tca.interChain, ca.interKey = []*x509.Certificate{interCert}, interKey\n\n\t\t\tlog.Info(\"renewed intermediate\",\n\t\t\t\tzap.Time(\"new_expiration\", ca.interChain[0].NotAfter),\n\t\t\t)\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// needsRenewal reports whether the certificate is within its renewal window\n// (i.e. the fraction of lifetime remaining is less than or equal to RenewalWindowRatio).\nfunc (ca *CA) needsRenewal(cert *x509.Certificate) bool {\n\tratio := ca.RenewalWindowRatio\n\tif ratio <= 0 {\n\t\tratio = defaultRenewalWindowRatio","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/maintain.go#L73-L109","documentation":"Emitted by renewCertsForCA (modules/caddypki/maintain.go:91) when the intermediate certificate is expiring and genIntermediate fails after the root key was loaded successfully. Causes include a root key that does not match the root certificate (verifyKeysMatch failure inside loading), certificate-generation errors (unsupported signature algorithm, invalid lifetime), or entropy/OS failures while signing.","triggerScenarios":"ca.needsRenewal(ca.interChain[0]) is true, ca.Intermediate is not manually configured, loadOrGenRoot succeeds, then ca.genIntermediate(rootCert, rootKey) returns an error - typically because the on-disk root key pairs with a different root certificate, or signing constraints (e.g. RSA key too small for the requested signature algorithm) are violated.","commonSituations":"Root certificate was replaced without replacing the root key; mixed files after a botched CA migration; old Caddy versions' storage reused with new key formats; a root key generated with an algorithm the current build's dependency chain rejects.","solutions":["Check the wrapped error: if it mentions key type/mismatch, align root cert and root key files (same CA, same key) or delete both from <storage>/pki/authorities/<id>/ to force regeneration","Regenerate the whole CA pair together and re-trust the new root: rm -rf <storage>/pki/authorities/local then restart Caddy, then re-install the root cert (caddy trust / manually add to the trust store)","Upgrade to the current Caddy release to pick up fixes in certificate generation","If it recurs on every maintenance tick, capture the wrapped error in logs and validate the pair manually with openssl x509 and openssl pkey"],"exampleFix":"# before: mismatched root pair forces intermediate regeneration to fail every 12h\nsudo ls /var/lib/caddy/pki/authorities/local/   # root.crt new, root.key old\n\n# after: force a clean, self-consistent CA\nsudo systemctl stop caddy\nsudo rm -rf /var/lib/caddy/pki/authorities/local\nsudo systemctl start caddy\ncaddy trust   # re-install the freshly generated root","handlingStrategy":"retry","validationCode":"// ensure the root pair on disk is self-consistent so genIntermediate cannot fail on mismatch\nfunc rootPairConsistent(rootCertPEM, rootKeyPEM []byte) error {\n\tcb, _ := pem.Decode(rootCertPEM)\n\tcrt, err := x509.ParseCertificate(cb.Bytes)\n\tif err != nil {\n\t\treturn err\n\t}\n\tkb, _ := pem.Decode(rootKeyPEM)\n\tkey, err := x509.ParsePKCS8PrivateKey(kb.Bytes)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !crt.PublicKey.(interface{ Equal(crypto.PublicKey) bool }).Equal(key.(crypto.Signer).Public()) {\n\t\treturn errors.New(\"root cert and root key do not match\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if _, _, err := ca.genIntermediate(rootCert, rootKey); err != nil {\n    log.Error(\"intermediate regeneration failed\", zap.Error(err))\n    // maintenance loop retries each interval; if the cause is a mismatched\n    // root pair, fix or delete the authority's storage subtree to regenerate\n}","preventionTips":["Never replace root.crt without the matching root.key; treat them as one unit in change management","Verify pair consistency after restores: openssl x509 -noout -modulus comparisons (RSA) or a test signature","Keep Caddy updated; intermediate-generation fixes land in maintenance releases","Alert on repeated 'generating new certificate' errors well before the intermediate's NotAfter"],"tags":["pki","maintenance","intermediate","renewal","key-mismatch"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}