{"record":{"id":"6e4b2a5377d54118","repo":"caddyserver/caddy","slug":"encoding-root-key-v","errorCode":null,"errorMessage":"encoding root key: %v","messagePattern":"encoding root key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/ca.go","lineNumber":335,"sourceCode":"\nfunc (ca CA) genRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {\n\trepl := ca.newReplacer()\n\n\trootCert, rootKey, err = generateRoot(repl.ReplaceAll(ca.RootCommonName, \"\"))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"generating CA root: %v\", err)\n\t}\n\trootCertPEM, err := pemEncodeCert(rootCert.Raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding root certificate: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyRootCert(), rootCertPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving root certificate: %v\", err)\n\t}\n\trootKeyPEM, err := certmagic.PEMEncodePrivateKey(rootKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding root key: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyRootKey(), rootKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving root key: %v\", err)\n\t}\n\n\treturn rootCert, rootKey, nil\n}\n\nfunc (ca CA) loadOrGenIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCertChain []*x509.Certificate, interKey crypto.Signer, err error) {\n\tvar interCert *x509.Certificate\n\tinterCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateCert())\n\tif err != nil {\n\t\tif !errors.Is(err, fs.ErrNotExist) {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate cert: %v\", err)\n\t\t}\n\n\t\t// TODO: should we require that all or none of the assets are required before overwriting anything?","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L317-L353","documentation":"genRoot PEM-encodes the root private key with certmagic.PEMEncodePrivateKey before storing it. If the signer cannot be serialized to PEM (unsupported key type or nil signer from generation), the wrap 'encoding root key' aborts root creation before the key is saved. Like 589, this is an internal-invariant failure, not environmental.","triggerScenarios":"PEMEncodePrivateKey(rootKey) errors: the generated signer is of a type the encoder cannot handle (custom/test signer injected, unusual algorithm) or generation returned a nil/invalid signer despite no error. Only on the new-root path.","commonSituations":"Rare in stock Caddy (ECDSA P-256 encodes fine). Appears with code that injects custom crypto.Signer implementations, source modifications, or corrupted library builds.","solutions":["Run an unmodified, current Caddy build.","If you inject a custom signer or fork the code, ensure it is a standard *ecdsa.PrivateKey or ed25519 key that certmagic can encode.","If reproducible on stock builds, capture the wrapped error and report upstream."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// internal invariant: capture wrapped error, retry once, report upstream if repeated\nif strings.Contains(err.Error(), \"encoding root key\") { retryOrReport(err) }","preventionTips":["Use unmodified builds for PKI-critical deployments.","If customizing signers, stick to *ecdsa.PrivateKey/ed25519 types certmagic can encode.","Capture and archive first-boot logs so rare encoding faults are diagnosable."],"tags":["pki","root-key","pem","encoding"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}