{"record":{"id":"46c9d703ee79da51","repo":"EpicGames/lore","slug":"failed-to-write-ephemeral-certificate-e","errorCode":null,"errorMessage":"failed to write ephemeral certificate {}: {e}","messagePattern":"failed to write ephemeral certificate (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lore-server/src/server.rs","lineNumber":1087,"sourceCode":"    std::fs::create_dir_all(&dir).map_err(|e| {\n        anyhow!(\n            \"failed to create directory {} for ephemeral certificate: {e}\",\n            dir.display()\n        )\n    })?;\n\n    let process_id = std::process::id();\n    let cert_file = dir.join(format!(\"{endpoint}-{process_id}-cert.pem\"));\n    let pkey_file = dir.join(format!(\"{endpoint}-{process_id}-key.pem\"));\n\n    let generated = lore_transport::tls::generate_self_signed(vec![\n        \"localhost\".to_string(),\n        \"127.0.0.1\".to_string(),\n        \"::1\".to_string(),\n    ])?;\n\n    std::fs::write(&cert_file, generated.cert_pem).map_err(|e| {\n        anyhow!(\n            \"failed to write ephemeral certificate {}: {e}\",\n            cert_file.display()\n        )\n    })?;\n    std::fs::write(&pkey_file, generated.key_pem).map_err(|e| {\n        anyhow!(\n            \"failed to write ephemeral private key {}: {e}\",\n            pkey_file.display()\n        )\n    })?;\n\n    warn!(\n        endpoint,\n        cert = %cert_file.display(),\n        key = %pkey_file.display(),\n        \"No TLS certificate configured for the '{endpoint}' QUIC endpoint; generated an \\\n         EPHEMERAL SELF-SIGNED certificate. This is untrusted, regenerated on every restart, \\\n         and intended for local development only. Configure a real certificate for production.\"","sourceCodeStart":1069,"sourceCodeEnd":1105,"githubUrl":"https://github.com/EpicGames/lore/blob/074eb0b0d1194c997d7cf28b55519e3e197b3e23/lore-server/src/server.rs#L1069-L1105","documentation":"After generating the ephemeral key pair, generate_ephemeral_certificate writes the PEM certificate to a file under <tmp>/lore-server with std::fs::write, mapping any IO error to this message with the full file path and OS error. The endpoint setup later reads this file, so a failed write aborts startup. Failures here mean the directory was creatable but the file write itself failed.","triggerScenarios":"std::fs::write(&cert_file, generated.cert_pem) fails — the target path exists as a directory, the file is owned by another user (from a previous root-run), the filesystem is full, or AV/security policy blocks writes there.","commonSituations":"Stale artifacts in /tmp/lore-server owned by root after switching the service to a non-root user; disk quota/full /tmp on a small container; SELinux/AppArmor denying writes to the temp path.","solutions":["Inspect the OS error: free disk space if 'No space left', or fix ownership of the existing cert file / /tmp/lore-server directory.","Clear stale ephemeral artifacts: remove old cert/key files under <tmp>/lore-server so the new write succeeds.","Run under a user that owns the temp directory, or point TMPDIR to a writable dedicated location.","Provide explicit certificate configuration to bypass the ephemeral path entirely."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Rust, preflight write test\nlet probe = dir.join(\".write-probe\");\nstd::fs::write(&probe, b\"ok\").map_err(|e| format!(\"{} not writable: {e}\", dir.display()))?;\nlet _ = std::fs::remove_file(&probe);","typeGuard":null,"tryCatchPattern":"match std::fs::write(&cert_file, &generated.cert_pem) {\n    Ok(()) => {},\n    Err(e) => {\n        eprintln!(\"cannot write {}: {e}; check ownership of {} and free disk space\", cert_file.display(), dir.display());\n        return Err(anyhow::Error::new(e).context(format!(\"ephemeral cert write failed: {}\", cert_file.display())));\n    }\n}","preventionTips":["After switching run users (root→app user), chown /tmp/lore-server or delete stale artifacts.","Monitor free space/quota on the volume backing TMPDIR.","Pin one server instance per machine temp dir; avoid concurrent instances sharing artifact names.","Prefer explicit certificate configuration to avoid ephemeral writes in production."],"tags":["filesystem","tls","certificate","write-failed"],"backgroundTag":"file-write-failed","analyzedSha":"074eb0b0d1194c997d7cf28b55519e3e197b3e23","analyzedAt":"2026-09-13T09:00:57.509Z","contentChangedAt":"2026-09-13T09:00:57.509Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}