{"record":{"id":"3936895031c55816","repo":"ory/hydra","slug":"failed-to-generate-private-key-s","errorCode":null,"errorMessage":"failed to generate private key: %s","messagePattern":"failed to generate private key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":311,"sourceCode":"\t\treturn nil, errors.WithStack(err)\n\t}\n\treturn &pem.Block{Type: \"PRIVATE KEY\", Bytes: b}, nil\n}\n\n// NewClientCert creates a new client TLS certificate signed by the given CA.\nfunc NewClientCert(CAcert *x509.Certificate, CAkey crypto.PrivateKey, opts ...CertificateOpts) (*tls.Certificate, error) {\n\tif !slices.Contains(CAcert.ExtKeyUsage, x509.ExtKeyUsageClientAuth) {\n\t\treturn nil, errors.Errorf(\"the CA certificate does not have the client authentication extended key usage (OID 1.3.6.1.5.5.7.3.2) set\")\n\t}\n\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\tserialNumber, err := rand.Int(rand.Reader, serialNumberLimit)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to generate serial number: %s\", err)\n\t}\n\n\tkey, err := rsa.GenerateKey(rand.Reader, 3072)\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed to generate private key: %s\", err)\n\t}\n\n\ttemplate := &x509.Certificate{\n\t\tSerialNumber: serialNumber,\n\t\tSubject: pkix.Name{\n\t\t\tOrganization: []string{\"Ory GmbH\"},\n\t\t\tCommonName:   \"ORY\",\n\t\t},\n\t\tIssuer:                CAcert.Subject,\n\t\tNotBefore:             time.Now().UTC(),\n\t\tNotAfter:              CAcert.NotAfter,\n\t\tKeyUsage:              x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  false,\n\t}\n\tfor _, opt := range opts {\n\t\topt(template)","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L293-L329","documentation":"NewClientCert always generates a fresh 3072-bit RSA key for the client certificate. If rsa.GenerateKey fails — practically only when the random source fails — the function returns this wrapped error. The failure is environmental: rsa.GenerateKey reads heavily from crypto/rand, so entropy problems surface here first.","triggerScenarios":"Calling NewClientCert in an environment where crypto/rand reads fail or stall during the RSA keygen loop — broken /dev/urandom, seccomp-blocked getrandom(2), or a kernel entropy shortage on legacy systems.","commonSituations":"CI containers with restricted device access; embedded/minimal images missing /dev/urandom; old VMs generating keys immediately after boot before entropy is seeded.","solutions":["Ensure the runtime has a working /dev/urandom and that seccomp policies allow getrandom(2).","Retry — if the cause is transient entropy exhaustion, subsequent attempts succeed after the kernel pools are seeded.","Move key generation to a host with a healthy RNG or a hardware entropy source."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if f, err := os.Open(\"/dev/urandom\"); err != nil {\n    // RNG device missing — generation will fail\n} else {\n    f.Close()\n}","typeGuard":null,"tryCatchPattern":"client, err := tlsx.NewClientCert(caCert, caKey)\nif err != nil && strings.Contains(err.Error(), \"failed to generate private key\") {\n    // rsa.GenerateKey RNG failure: fix random source, then retry\n}","preventionTips":["Ensure the container image includes /dev/urandom and does not strip device nodes.","Allow getrandom(2) in sandbox syscall filters — RSA keygen draws heavily on crypto/rand.","Generate keys on a host with adequate entropy or an RNG device (e.g. virtio-rng)."],"tags":["crypto","tls","rsa","environment"],"backgroundTag":"crypto-rand-unavailable","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}