{"record":{"id":"7756f202bd71481f","repo":"coollabsio/coolify","slug":"failed-to-export-certificate-openssl-error-strin","errorCode":null,"errorMessage":"Failed to export certificate: {openssl_error_string()}","messagePattern":"Failed to export certificate: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":152,"sourceCode":"            $certificate = openssl_csr_sign(\n                $csr,\n                $caCert ?? null,\n                $caKey ?? $privateKey,\n                $validityDays,\n                [\n                    'digest_alg' => 'sha512',\n                    'config' => $tempConfigPath,\n                    'x509_extensions' => 'v3_req',\n                ],\n                random_int(1, PHP_INT_MAX)\n            );\n\n            if ($certificate === false) {\n                throw new \\RuntimeException('Failed to sign certificate: '.openssl_error_string());\n            }\n\n            if (! openssl_x509_export($certificate, $certificateStr)) {\n                throw new \\RuntimeException('Failed to export certificate: '.openssl_error_string());\n            }\n\n            SslCertificate::query()\n                ->where('resource_type', $resourceType)\n                ->where('resource_id', $resourceId)\n                ->where('server_id', $serverId)\n                ->delete();\n\n            $sslCertificate = SslCertificate::create([\n                'ssl_certificate' => $certificateStr,\n                'ssl_private_key' => $privateKeyStr,\n                'resource_type' => $resourceType,\n                'resource_id' => $resourceId,\n                'server_id' => $serverId,\n                'configuration_dir' => $configurationDir,\n                'mount_path' => $mountPath,\n                'valid_until' => CarbonImmutable::now()->addDays($validityDays),\n                'is_ca_certificate' => $isCaCertificate,","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L134-L170","documentation":"openssl_x509_export() returned false while converting the just-signed certificate resource to PEM. Almost always an artifact of a broken OpenSSL configuration or a corrupted certificate resource from a partially failed signing step; the appended openssl_error_string() identifies which.","triggerScenarios":"Certificate generation on hosts with a missing/unreadable openssl.cnf (export routines depend on it) or where an upstream step degraded the resource; runs immediately after openssl_csr_sign succeeded.","commonSituations":"Same environments as the other SslHelper OpenSSL failures: minimal container images, bad OPENSSL_CONF, mounted config files removed at runtime.","solutions":["Apply the same fixes as for key export: valid openssl.cnf, correct OPENSSL_CONF, writable temp paths.","Re-run generation after fixing the environment — a one-off corrupt resource is resolved by regeneration.","Check openssl_error_string() output to distinguish config errors from certificate errors."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName);\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), 'Failed to export certificate')) {\n        report('Certificate export failed: '.$e->getMessage()); // carries openssl_error_string()\n        return null;\n    }\n    throw $e;\n}","preventionTips":["Same environment hygiene as the other OpenSSL steps: valid openssl.cnf, writable temp dir.","Treat any single step failing as an environment smell — fix it once rather than per-certificate.","Cache generated certificates (SslCertificate records) so transient regeneration failures don't affect running services."],"tags":["ssl","openssl","certificate-export","php"],"backgroundTag":"openssl-certificate-export-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}