{"record":{"id":"3845ccc852144ad5","repo":"siyuan-note/siyuan","slug":"failed-to-generate-tls-server-certificate-w","errorCode":null,"errorMessage":"failed to generate TLS server certificate: %w","messagePattern":"failed to generate TLS server certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"kernel/util/tls_cert_manager.go","lineNumber":160,"sourceCode":"\t\t(localIP == nil || certificateContainsIP(currentState.leaf, localIP)) {\n\t\treturn &currentState.certificate, nil\n\t}\n\n\tprivateKey, ok := currentState.certificate.PrivateKey.(crypto.Signer)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"TLS server private key does not implement crypto.Signer\")\n\t}\n\n\tcaCert, caKey, err := loadCA(manager.caCertPath, manager.caKeyPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load CA certificates: %w\", err)\n\t}\n\n\tipAddresses := collectServerCertificateIPs(currentState.leaf.IPAddresses, localIP)\n\tdnsNames := collectServerCertificateDNSNames(currentState.leaf.DNSNames)\n\tcertDER, leaf, err := createServerCertificate(caCert, caKey, privateKey, ipAddresses, dnsNames)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate TLS server certificate: %w\", err)\n\t}\n\n\tcertificate := tls.Certificate{\n\t\tCertificate: [][]byte{certDER},\n\t\tPrivateKey:  privateKey,\n\t\tLeaf:        leaf,\n\t}\n\tnewState := &tlsCertificateState{certificate: certificate, leaf: leaf}\n\tmanager.state.Store(newState)\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tif err = gulu.File.WriteFileSafer(manager.certPath, certPEM, 0644); err != nil {\n\t\tlogging.LogWarnf(\"failed to persist refreshed TLS server certificate: %s\", err)\n\t}\n\n\tif localIP == nil {\n\t\tlogging.LogInfof(\"refreshed TLS server certificate before expiration\")\n\t} else {","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/kernel/util/tls_cert_manager.go#L142-L178","documentation":"refreshCertificate issues a fresh server leaf certificate with createServerCertificate, signing it with the loaded CA. If X.509 template construction or signing fails (invalid SAN input, unsupported key algorithm, signing errors), the failure is wrapped as this error and the TLS handshake cannot proceed.","triggerScenarios":"GetCertificate forces a refresh and createServerCertificate fails — e.g. the leaf template gets zero/invalid IP or DNS SANs, the CA key algorithm is incompatible, or x509.CreateCertificate returns an error such as 'certificate validity period out of range' due to a bad system clock.","commonSituations":"Server running on a host whose local IP changed (new SAN) while the CA is malformed, incorrect system clock causing invalid validity windows, or exotic CA keys (e.g. Ed25519 CA with restrictions).","solutions":["Inspect the wrapped cause; fix SAN inputs (ensure the CA-derived leaf has at least one valid IP/DNS SAN)","Correct the system clock/timezone if the validity period was out of range","Regenerate the CA pair (delete CA files and restart) if the CA key is unusable for signing","Ensure crypto.Signer keys are supported (RSA/ECDSA) by the CA"],"exampleFix":"// before: system clock set to 1970 -> createServerCertificate: validity out of range\n// after: sync system time, then\nstate, err := currentState.refreshCertificate(localIP) // succeeds","handlingStrategy":"try-catch","validationCode":"// verify system clock sanity before issuing certs\nif skew := time.Since(time.Now().UTC()).Abs(); skew > time.Hour {\n\t// system clock unreliable: certificate validity windows will be wrong\n}","typeGuard":null,"tryCatchPattern":"cert, err := certManager.GetCertificate(hello)\nif err != nil {\n\tlogging.LogErrorf(\"certificate refresh failed: %s\", err)\n\treturn nil, err // fail the handshake rather than serving a stale cert\n}","preventionTips":["Keep the system clock synchronized (NTP); bad clocks break x509 validity windows","Ensure CA keys use supported algorithms (RSA/ECDSA) usable for signing","Verify SAN inputs (IPs/DNS names) are non-empty before refresh","Regenerate the CA if signing repeatedly fails with template errors"],"tags":["tls","certificate","x509","signing"],"backgroundTag":"internal-invariant-violation","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}