{"record":{"id":"7305b0cf864ecc99","repo":"coollabsio/coolify","slug":"ssl-certificate-generation-failed-e-getmessage","errorCode":null,"errorMessage":"SSL Certificate generation failed: {$e->getMessage()}","messagePattern":"SSL Certificate generation failed: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":228,"sourceCode":"                        'resource_type' => $resourceType,\n                        'resource_id' => $resourceId,\n                    ]);\n\n                    $model->fileStorages()->create([\n                        'fs_path' => $configurationDir.'/ssl/server.key',\n                        'mount_path' => $mountPath.'/server.key',\n                        'content' => $privateKeyStr,\n                        'is_directory' => false,\n                        'chmod' => '600',\n                        'resource_type' => $resourceType,\n                        'resource_id' => $resourceId,\n                    ]);\n                }\n            }\n\n            return $sslCertificate;\n        } catch (\\Throwable $e) {\n            throw new \\RuntimeException('SSL Certificate generation failed: '.$e->getMessage(), 0, $e);\n        } finally {\n            fclose($tempConfig);\n        }\n    }\n}\n","sourceCodeStart":210,"sourceCodeEnd":234,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L210-L234","documentation":"This is the catch-all wrapper at the end of SslHelper::generateSslCertificate(): any Throwable thrown inside the method (private key generation/export, CSR creation, signing, cert export, temp-file handling) is rethrown as a RuntimeException prefixed 'SSL Certificate generation failed:'. The suffix is the underlying exception message — that is the real error to diagnose.","triggerScenarios":"Any failure during certificate issuance: the OpenSSL key/CSR/sign/export errors from this helper, temp config file write failures, or SslCertificate model persistence errors. Triggered whenever Coolify generates certificates for resources (e.g. enabling SSL on a service/app).","commonSituations":"Misconfigured OpenSSL in the PHP runtime (see the specific inner errors); full disk preventing temp config creation; invalid CA inputs when issuing CA-signed certificates.","solutions":["Read the text after 'SSL Certificate generation failed:' — it names the exact failing step (key, CSR, signing, export) and the OpenSSL error string.","Fix the underlying cause using the guidance for that inner error (extension/config/CA pair).","Verify environment basics: OpenSSL extension loaded, openssl.cnf readable, /tmp writable, disk space available."],"exampleFix":"// before: only the wrapper message surfaces\ntry {\n    SslHelper::generateSslCertificate($commonName);\n} catch (\\RuntimeException $e) {\n    log($e->getMessage()); // 'SSL Certificate generation failed: Failed to generate CSR: ...'\n}\n\n// after: log the previous exception chain for the real cause\ncatch (\\RuntimeException $e) {\n    while ($e) {\n        log($e->getMessage());\n        $e = $e->getPrevious();\n    }\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName, $sans);\n} catch (\\RuntimeException $e) {\n    // unwrap the chain: the innermost message is the real cause\n    $cause = $e;\n    while ($cause->getPrevious()) {\n        $cause = $cause->getPrevious();\n    }\n    report(\"SSL generation failed: {$cause->getMessage()}\");\n    return null; // fall back to existing certificate if present\n}","preventionTips":["Always inspect getPrevious() — the wrapper message alone hides the failing step.","Run an OpenSSL capability smoke test (key new/export) during deploy or install, not at first certificate request.","Keep existing SslCertificate rows valid until the replacement is successfully generated."],"tags":["ssl","openssl","certificate","error-wrapping"],"backgroundTag":"ssl-certificate-generation-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}