{"record":{"id":"7705c02df703e7b1","repo":"cloudflare/cloudflared","slug":"d-s","errorCode":null,"errorMessage":"%d: %s","messagePattern":"%d: %s","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sshgen/sshgen.go","lineNumber":134,"sourceCode":"\t\tclient := http.Client{\n\t\t\tTimeout: 10 * time.Second,\n\t\t}\n\t\tres, err = client.Post(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t}\n\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to send request\")\n\t}\n\tdefer res.Body.Close()\n\n\tdecoder := json.NewDecoder(res.Body)\n\n\tif res.StatusCode != 200 {\n\t\tvar errResponse errorResponse\n\t\tif err := decoder.Decode(&errResponse); err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"%d: %s\", errResponse.Status, errResponse.Message)\n\t}\n\n\tvar signRes signResponse\n\tif err := decoder.Decode(&signRes); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to decode HTTP response\")\n\t}\n\treturn signRes.Certificate, nil\n}\n\n// generateKeyPair creates a EC keypair (P256) and stores them in the homedir.\n// returns the generated public key from the successful keypair generation\nfunc generateKeyPair(fullName string) ([]byte, error) {\n\tpubKeyName := fullName + \".pub\"\n\n\texist, err := config.FileExists(pubKeyName)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/sshgen/sshgen.go#L116-L152","documentation":"SignCert calls cloudflared's certificate-signing service and expects a 200 response. On a non-200 status it attempts to decode an errorResponse body and returns '<status>: <message>' so the caller (handleCertificateGeneration) sees the HTTP status code and the service's error message describing why the CSR could not be signed.","triggerScenarios":"The remote sign service returns a non-200 status with a JSON error body (e.g. 400 for a malformed CSR, 401/403 for bad credentials/token, 429 rate limit, 5xx server error), and the body successfully decodes into errorResponse.","commonSituations":"Expired or missing Cloudflare API token when requesting SSH certificates; uploading a CSR with an unsupported key type or invalid principal; Cloudflare SSH infrastructure returning transient 5xx; corporate proxies injecting HTML error pages that still decode oddly or fail decode and surface the raw error instead.","solutions":["Inspect the numeric status in the error message: 401/403 means fix your API token/credentials, 400 means fix the CSR or request payload.","Regenerate or refresh the API token used by `cloudflared access ssh-gen` / certificate generation.","Validate the CSR (algorithm, principals) before submission; re-generate with a supported key type (e.g. ed25519).","If the status is 429/5xx, wait and retry; check the Cloudflare status page for incidents.","Capture the full error and Cloudflare support details (account/tag) if the problem persists."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// client side: avoid UDP ASSOCIATE; TCP CONNECT only\nif cmd == socks.CmdAssociate {\n\treturn errors.New(\"cloudflared socks5 does not support UDP ASSOCIATE\")\n}","typeGuard":null,"tryCatchPattern":"if err := sendReply(conn, commandNotSupported, nil); err != nil {\n\treturn fmt.Errorf(\"failed to send ASSOCIATE refusal: %w\", err)\n}","preventionTips":["Route UDP-heavy apps through a proxy that supports UDP ASSOCIATE, not cloudflared SOCKS5.","Handle commandNotSupported (0x07) replies gracefully in client code.","Keep the connection open until the reply is consumed to avoid noisy send failures."],"tags":["http","ssh","certificate","api"],"backgroundTag":"http-non-200-response","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}