{"record":{"id":"34fad3fa670693ae","repo":"argoproj/argo-workflows","slug":"failed-to-create-certificate-w","errorCode":null,"errorMessage":"failed to create certificate: %w","messagePattern":"failed to create certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/tls/tls.go","lineNumber":88,"sourceCode":"\t\tNotBefore: notBefore,\n\t\tNotAfter:  notAfter,\n\n\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},\n\t\tBasicConstraintsValid: true,\n\t}\n\n\tfor _, h := range hosts {\n\t\tif ip := net.ParseIP(h); ip != nil {\n\t\t\ttemplate.IPAddresses = append(template.IPAddresses, ip)\n\t\t} else {\n\t\t\ttemplate.DNSNames = append(template.DNSNames, h)\n\t\t}\n\t}\n\n\tcertBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to create certificate: %w\", err)\n\t}\n\treturn certBytes, privateKey, nil\n}\n\n// generatePEM generates a new certificate and key and returns it as PEM encoded bytes\nfunc generatePEM() ([]byte, []byte, error) {\n\tcertBytes, privateKey, err := generate()\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tcertpem := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certBytes})\n\tkeypem := pem.EncodeToMemory(pemBlockForKey(privateKey))\n\treturn certpem, keypem, nil\n}\n\n// GenerateX509KeyPair generates a X509 key pair\nfunc GenerateX509KeyPair() (*tls.Certificate, error) {\n\tcertpem, keypem, err := generatePEM()","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/tls/tls.go#L70-L106","documentation":"The call to x509.CreateCertificate failed while building Argo's self-signed TLS certificate (localhost, ECDSA P-256 key). The template and keys are constructed internally by the library, so this indicates the crypto library rejected the certificate construction or the private key, not user configuration.","triggerScenarios":"generate() reaches x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey) and it errors — typically due to a crypto/x509 internal failure, an unsupported/invalid ECDSA key, or a Go crypto policy restricting the algorithm (e.g. FIPS mode disallowing P-256 ECDSA signing).","commonSituations":"FIPS-restricted or hardened Go builds (GODEBUG crypto settings) rejecting ECDSA, corrupted crypto/rand output, or platform crypto policy changes after a Go/OS upgrade.","solutions":["Check for crypto policy restrictions (GODEBUG=fips140=on / tls-max settings) that reject ECDSA P-256 and relax or configure an allowed algorithm","Retry after restarting the process — transient RNG/key failures resolve on regeneration","Verify the Go version / OS crypto libraries are not broken (rebuild or upgrade)","Bypass self-signed generation entirely by providing your own cert via a Kubernetes TLS secret (GetServerTLSConfigFromSecret path)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: confirm a key can be generated and self-signed under current crypto policy\nkey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\nif err != nil { return err }","typeGuard":null,"tryCatchPattern":"cfg, err := tls.GenerateX509KeyPairTLSConfig(minVer)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to create certificate\") {\n        // fall back to user-provided secret-based certs\n        return tls.GetServerTLSConfigFromSecret(ctx, kube, secretName, minVer, ns)\n    }\n    return err\n}","preventionTips":["Avoid FIPS/crypto-policy modes that forbid ECDSA P-256, or configure allowed algorithms","Provide server certs via a TLS secret (GetServerTLSConfigFromSecret) to skip self-signed generation","Keep Go runtime and OS crypto libraries up to date"],"tags":["tls","crypto","x509","self-signed-certificate"],"backgroundTag":"certificate-generation-failed","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}