{"record":{"id":"6cc4d2486b89aa7c","repo":"ory/hydra","slug":"failed-to-generate-serial-number-s","errorCode":null,"errorMessage":"failed to generate serial number: %s","messagePattern":"failed to generate serial number: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":252,"sourceCode":"\t\treturn nil, err\n\t}\n\n\tpemCert := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: c.Raw})\n\tpemKey := pem.EncodeToMemory(block)\n\tcert, err := tls.X509KeyPair(pemCert, pemKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &cert, nil\n}\n\n// CreateSelfSignedCertificate creates a self-signed x509 certificate.\nfunc CreateSelfSignedCertificate(key interface{}, opts ...CertificateOpts) (cert *x509.Certificate, err error) {\n\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\tserialNumber, err := rand.Int(rand.Reader, serialNumberLimit)\n\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to generate serial number: %s\", err)\n\t}\n\n\tcertificate := &x509.Certificate{\n\t\tSerialNumber: serialNumber,\n\t\tSubject: pkix.Name{\n\t\t\tOrganization: []string{\"ORY GmbH\"},\n\t\t\tCommonName:   \"ORY\",\n\t\t},\n\t\tIssuer: pkix.Name{\n\t\t\tOrganization: []string{\"ORY GmbH\"},\n\t\t\tCommonName:   \"ORY\",\n\t\t},\n\t\tNotBefore:             time.Now().UTC(),\n\t\tNotAfter:              time.Now().UTC().Add(time.Hour * 24 * 31),\n\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  true,","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L234-L270","documentation":"CreateSelfSignedCertificate generates a cryptographically random 128-bit serial number using crypto/rand. This error wraps any failure of rand.Int, which practically only happens when the operating system's random source (/dev/urandom or getrandom) is unavailable or fails. It is an environment/OS-level failure, not a misuse of the API.","triggerScenarios":"Calling CreateSelfSignedCertificate (directly or via GetOrCreateTLSCertificate / GenerateTLSCertificateFilesForTests) when crypto/rand.Reader fails to read — e.g. a container with a broken /dev/urandom, seccomp restrictions blocking getrandom(2), or severe kernel entropy exhaustion on old kernels.","commonSituations":"Hardened Docker/Kubernetes sandboxes with seccomp profiles blocking getrandom; minimal chroots lacking /dev/urandom; legacy VMs with entropy-starved kernels during early boot.","solutions":["Fix the environment's random source: mount /dev/urandom in the container and review seccomp profiles to allow getrandom(2).","Retry the call — the failure is typically transient if caused by temporary entropy exhaustion.","Update the kernel/host: modern Linux (3.17+) getrandom implementations do not block after boot."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"if _, err := rand.Int(rand.Reader, big.NewInt(1)); err != nil {\n    // environment RNG is broken; surface before calling CreateSelfSignedCertificate\n}","typeGuard":null,"tryCatchPattern":"cert, err := tlsx.CreateSelfSignedCertificate(key)\nif err != nil && strings.Contains(err.Error(), \"failed to generate serial number\") {\n    // RNG failure: check /dev/urandom availability, retry after fixing environment\n}","preventionTips":["Mount /dev/urandom and allow getrandom(2) in container seccomp profiles.","Smoke-test crypto/rand availability at service startup.","Avoid generating certificates immediately after boot on entropy-starved hosts."],"tags":["crypto","tls","random-generation","environment"],"backgroundTag":"crypto-rand-unavailable","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}