{"record":{"id":"34683e5900533778","repo":"AdguardTeam/AdGuardHome","slug":"creating-dnscrypt-cert-w","errorCode":null,"errorMessage":"creating dnscrypt cert: %w","messagePattern":"creating dnscrypt cert: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/home/dns.go","lineNumber":392,"sourceCode":"\tif extTLSConf.DNSCryptConfigFile == \"\" {\n\t\treturn nil, fmt.Errorf(\"dnscrypt_config_file: %w\", errors.ErrEmptyValue)\n\t}\n\n\tf, err := os.Open(extTLSConf.DNSCryptConfigFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"opening dnscrypt config: %w\", err)\n\t}\n\tdefer func() { err = errors.WithDeferred(err, f.Close()) }()\n\n\trc := &dnscrypt.ResolverConfig{}\n\terr = yaml.NewDecoder(f).Decode(rc)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding dnscrypt config: %w\", err)\n\t}\n\n\tcert, err := rc.NewCert()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating dnscrypt cert: %w\", err)\n\t}\n\n\treturn &dnsforward.DNSCryptConfig{\n\t\tResolverCert:   cert,\n\t\tUDPListenAddrs: ipsToUDPAddrs(addrs, extTLSConf.PortDNSCrypt),\n\t\tTCPListenAddrs: ipsToTCPAddrs(addrs, extTLSConf.PortDNSCrypt),\n\t\tProviderName:   rc.ProviderName,\n\t}, nil\n}\n\n// dnsEncryption contains different types of TLS encryption addresses.\ntype dnsEncryption struct {\n\thttps string\n\ttls   string\n\tquic  string\n}\n\n// getDNSEncryption returns the TLS encryption addresses that AdGuard Home","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/dns.go#L374-L410","documentation":"The parsed DNSCrypt ResolverConfig was rejected by rc.NewCert(), which builds the dnscrypt.ServerCert from the provider name, keys, and secret. Failure means the cryptographic material is invalid or inconsistent — bad hex keys, secret length wrong, or an unsupported certificate file type/signature mismatch.","triggerScenarios":"rc.NewCert() errors when public_key/private_key are not valid 32-byte hex, cert_secret has the wrong length, provider_name is malformed (must look like 2.dnscrypt-cert.<domain>), or cert_file_type is not 0/1/2/3.","commonSituations":"Regenerating only one of the key pair, copying keys with typos/truncated hex, rotating keys without updating provider name, or wrong cert_file_type after changing hash algorithm.","solutions":["Regenerate the full keypair and config together: dnscrypt generate-cert --provider-name 2.dnscrypt-cert.example.com and use ALL emitted values","Verify public_key/private_key are exactly 64 hex chars each and cert_secret is 32 hex chars","Ensure provider_name matches the '<version>.dnscrypt-cert.<domain>' pattern","Confirm cert_file_type matches the certificate format (0=plain, 1=rsa, 2=edge, 3=rsa8)"],"exampleFix":"# regenerate a consistent set\ndnscrypt generate-cert \\\n  --provider-name 2.dnscrypt-cert.example.com \\\n  --out dnscrypt.yaml\n# then point tls.dnscrypt_config_file at the new file and restart","handlingStrategy":"validation","validationCode":"// structural pre-check of key material\nimport \"encoding/hex\"\nfunc keysConsistent(rc dnscrypt.ResolverConfig) error {\n    if len(rc.PublicKey) != 64 || len(rc.PrivateKey) != 64 { return fmt.Errorf(\"keys must be 64 hex chars\") }\n    if _, err := hex.DecodeString(rc.PublicKey); err != nil { return fmt.Errorf(\"bad public_key hex\") }\n    if _, err := hex.DecodeString(rc.PrivateKey); err != nil { return fmt.Errorf(\"bad private_key hex\") }\n    return nil\n}","typeGuard":"func validProviderName(name string) bool {\n    parts := strings.Split(name, \".\")\n    return len(parts) >= 4 && parts[1] == \"dnscrypt-cert\"\n}","tryCatchPattern":"if _, err := rc.NewCert(); err != nil {\n    // regenerate the whole config — partial key edits never recover\n    log.Error(\"dnscrypt cert invalid; regenerate keypair\", slogutil.KeyError, err)\n}","preventionTips":["Always rotate public_key/private_key/cert_secret together via generate-cert","Never hand-truncate or retype hex key material","Store the generated dnscrypt config write-protected to prevent drift"],"tags":["dns","adguard-home","dnscrypt","cryptography","key-mismatch"],"backgroundTag":"invalid-cryptographic-key","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}