{"record":{"id":"476fba71f18363df","repo":"kgretzky/evilginx2","slug":"private-key-generation-failed","errorCode":null,"errorMessage":"private key generation failed","messagePattern":"private key generation failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/certdb.go","lineNumber":94,"sourceCode":"\t}\n\treturn email\n}\n\nfunc (o *CertDb) generateCertificates() error {\n\tvar key *rsa.PrivateKey\n\n\tpkey, err := ioutil.ReadFile(filepath.Join(o.cache_dir, \"private.key\"))\n\tif err != nil {\n\t\tpkey, err = ioutil.ReadFile(filepath.Join(o.cache_dir, \"ca.key\"))\n\t}\n\n\tif err != nil {\n\t\t// private key corrupted or not found, recreate and delete all public certificates\n\t\tos.RemoveAll(filepath.Join(o.cache_dir, \"*\"))\n\n\t\tkey, err = rsa.GenerateKey(rand.Reader, 2048)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"private key generation failed\")\n\t\t}\n\t\tpkey = pem.EncodeToMemory(&pem.Block{\n\t\t\tType:  \"RSA PRIVATE KEY\",\n\t\t\tBytes: x509.MarshalPKCS1PrivateKey(key),\n\t\t})\n\t\terr = ioutil.WriteFile(filepath.Join(o.cache_dir, \"ca.key\"), pkey, 0600)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t} else {\n\t\tblock, _ := pem.Decode(pkey)\n\t\tif block == nil {\n\t\t\treturn fmt.Errorf(\"private key is corrupted\")\n\t\t}\n\n\t\tkey, err = x509.ParsePKCS1PrivateKey(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn err","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/certdb.go#L76-L112","documentation":"generateCertificates (called from NewCertDb) throws this when crypto/rand rsa.GenerateKey(2048) fails during regeneration of the CA private key. The previous key was already determined to be missing or corrupted, so this is a last-resort failure. It deliberately discards the underlying error detail and returns a fixed message.","triggerScenarios":"NewCertDb cannot read the cached ca.key, deletes the cache (os.RemoveAll of the cache dir), and then rsa.GenerateKey fails — practically only when the system CSPRNG (rand.Reader) fails or is unavailable (e.g. broken /dev/urandom in a stripped container).","commonSituations":"Containers/seccomp sandboxes blocking getrandom(); extremely constrained environments; corrupted cache_dir contents triggering the recreate path where a latent RNG problem then surfaces.","solutions":["Verify /dev/urandom is available and getrandom(2) is not blocked by the container/seccomp profile, then restart","Clear the cache_dir so a fresh, valid key can be written and re-run","Check disk permissions/space for writing ca.key (0600) in cache_dir","Update Go / the library if running on a platform with known crypto/rand issues"],"exampleFix":"// before\nos.RemoveAll(filepath.Join(o.cache_dir, \"*\")) // glob does not expand; cache may persist\n// after\nos.RemoveAll(o.cache_dir)\nos.MkdirAll(o.cache_dir, 0700)","handlingStrategy":"try-catch","validationCode":"// pre-check the environment before NewCertDb\nf, err := os.Open(\"/dev/urandom\")\nif err != nil { log.Fatal(\"no entropy source available\") }\nf.Close()\nif st, err := os.Stat(cacheDir); err != nil || !st.IsDir() { os.MkdirAll(cacheDir, 0700) }","typeGuard":null,"tryCatchPattern":"db, err := NewCertDb(cacheDir, \"\")\nif err != nil {\n    if err.Error() == \"private key generation failed\" {\n        // entropy/RNG issue: check /dev/urandom, seccomp, then retry\n        log.Fatal(\"cannot generate RSA key: check entropy source and container policy\")\n    }\n    log.Fatal(err)\n}","preventionTips":["Ensure /dev/urandom is accessible in containers; avoid seccomp rules blocking getrandom","Keep cache_dir writable with 0700 permissions","Monitor for repeated cache corruption that triggers the regenerate path","Pin a maintained Go version and library release"],"tags":["crypto","tls","rng","certificate"],"backgroundTag":"tls-key-generation-failed","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}