{"record":{"id":"5ac4a1ef3b096c69","repo":"tailscale/tailscale","slug":"acme-register-w","errorCode":null,"errorMessage":"acme.Register: %w","messagePattern":"acme\\.Register: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"feature/acme/cert.go","lineNumber":465,"sourceCode":"}\n\n// ensureAccount returns a valid ACME account, registering one if\n// needed. Locked so two first-time issuances don't both create one.\nfunc (e *extension) ensureAccount(ctx context.Context, ac *xacme.Client, logf logger.Logf, traceACME func(any)) (*xacme.Account, error) {\n\te.accountMu.Lock()\n\tdefer e.accountMu.Unlock()\n\ta, err := ac.GetReg(ctx, \"\" /* pre-RFC param */)\n\tswitch {\n\tcase err == nil:\n\t\tlogf(\"already had ACME account.\")\n\t\treturn a, nil\n\tcase err == xacme.ErrNoAccount:\n\t\ta, err = ac.Register(ctx, new(xacme.Account), xacme.AcceptTOS)\n\t\tif err == xacme.ErrAccountAlreadyExists {\n\t\t\ta, err = ac.GetReg(ctx, \"\" /* pre-RFC param */)\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"acme.Register: %w\", err)\n\t\t}\n\t\tlogf(\"registered ACME account.\")\n\t\ttraceACME(a)\n\t\treturn a, nil\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"acme.GetReg: %w\", err)\n\t}\n}\n\ntype acmeCertIssueArgs struct {\n\tcs            certStore           // certificate and ACME account storage\n\tlogf          logger.Logf         // logs ACME progress and failures\n\ttraceACME     func(any)           // optional hook for logging ACME messages\n\tdomain        string              // certificate domain being issued\n\topts          []xacme.OrderOption // ACME order options\n\tchallengeType acmeChallengeType   // challenge type to fulfill\n}\n","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/feature/acme/cert.go#L447-L483","documentation":"GetReg reported no account, so a new ACME account was registered (or re-fetched if it already existed) and that step failed. It means the CA rejected registration or the follow-up lookup: network failure, CA outage, rate limiting, or a rejected key.","triggerScenarios":"Thrown at feature/acme/cert.go:465 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check outbound HTTPS connectivity to the ACME directory URL.","Retry later if the CA reports rate limiting or an outage.","Regenerate the ACME account key if the CA rejects it."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}