{"record":{"id":"7e6249fa659922d3","repo":"tailscale/tailscale","slug":"acmekey-w","errorCode":null,"errorMessage":"acmeKey: %w","messagePattern":"acmeKey: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"feature/acme/certstore.go","lineNumber":394,"sourceCode":"\n\tprivKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tvar pemBuf bytes.Buffer\n\tif err := encodeECDSAKey(&pemBuf, privKey); err != nil {\n\t\treturn nil, err\n\t}\n\tif err := cs.WriteACMEKey(pemBuf.Bytes()); err != nil {\n\t\treturn nil, err\n\t}\n\treturn privKey, nil\n}\n\nfunc (e *extension) acmeClient(cs certStore) (*xacme.Client, error) {\n\tkey, err := e.acmeKey(cs)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"acmeKey: %w\", err)\n\t}\n\t// Note: if we add support for additional ACME providers (other than\n\t// LetsEncrypt), we should make sure that they support ARI extension (see\n\t// shouldStartDomainRenewalARI).\n\treturn &xacme.Client{\n\t\tKey:          key,\n\t\tUserAgent:    \"tailscaled/\" + version.Long(),\n\t\tDirectoryURL: envknob.String(\"TS_DEBUG_ACME_DIRECTORY_URL\"),\n\t}, nil\n}\n\n// validCertPEM reports whether the given certificate is valid for\n// domain at now.\n//\n// If roots != nil, it is used instead of the system root pool. This is\n// meant to support testing; production code should pass roots == nil.\nfunc validCertPEM(domain string, keyPEM, certPEM []byte, roots *x509.CertPool, now time.Time) bool {\n\tif len(keyPEM) == 0 || len(certPEM) == 0 {","sourceCodeStart":376,"sourceCodeEnd":412,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/feature/acme/certstore.go#L376-L412","documentation":"Raised by acmeClient when loading or creating the ACME account key from the cert store fails. It wraps the store or key generation error; without the account key no ACME client can be built.","triggerScenarios":"Thrown at feature/acme/certstore.go:394 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check permissions on the cert store directory or state store.","Remove a corrupt acme-account.key.pem so a new key is generated."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}