{"record":{"id":"81be3db6f36f6e55","repo":"juanfont/headscale","slug":"creating-certificates-for-derp-test-w","errorCode":null,"errorMessage":"creating certificates for derp test: %w","messagePattern":"creating certificates for derp test: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"integration/dsic/dsic.go","lineNumber":163,"sourceCode":") (*DERPServerInContainer, error) {\n\thash := rands.HexString(dsicHashLength)\n\n\t// Include run ID in hostname for easier identification of which test run owns this container\n\trunID := dockertestutil.GetIntegrationRunID()\n\n\tvar hostname string\n\n\tif runID != \"\" {\n\t\t// Use last 6 chars of run ID (the random hash part) for brevity\n\t\trunIDShort := runID[len(runID)-6:]\n\t\thostname = fmt.Sprintf(\"derp-%s-%s-%s\", runIDShort, strings.ReplaceAll(version, \".\", \"-\"), hash)\n\t} else {\n\t\thostname = fmt.Sprintf(\"derp-%s-%s\", strings.ReplaceAll(version, \".\", \"-\"), hash)\n\t}\n\n\ttlsCACert, tlsCert, tlsKey, err := integrationutil.CreateCertificate(hostname)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating certificates for derp test: %w\", err)\n\t}\n\n\tdsic := &DERPServerInContainer{\n\t\tversion:   version,\n\t\thostname:  hostname,\n\t\tpool:      pool,\n\t\tnetworks:  networks,\n\t\ttlsCACert: tlsCACert,\n\t\ttlsCert:   tlsCert,\n\t\ttlsKey:    tlsKey,\n\t\tstunPort:  3478, //nolint\n\t\tderpPort:  443,  //nolint\n\t}\n\n\t// Install the CA cert so the DERP server trusts its own certificate\n\t// and any headscale CA certs passed via [WithCACert].\n\tdsic.caCerts = append(dsic.caCerts, tlsCACert)\n","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/integration/dsic/dsic.go#L145-L181","documentation":"Returned by the DERP-in-container integration test helper (dsic) when integrationutil.CreateCertificate fails to generate the self-signed CA/server certificate for the DERPer's test hostname. It wraps the underlying crypto error from certificate generation.","triggerScenarios":"Calling NewDERPServerInContainer during an integration test run; CreateCertificate can fail on entropy exhaustion or malformed hostnames built from the runID/version/hash template.","commonSituations":"Integration test environment issues: containers with depleted entropy during cert generation, or a broken hostname string (e.g. version containing unexpected characters) producing an invalid CN.","solutions":["Re-run the integration test — transient entropy/crypto failures usually clear","Inspect the wrapped CreateCertificate error for the exact crypto failure (invalid CN, key generation)","Verify the version string and runID passed to the hostname template produce a sane DNS-like name"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"dsic, err := dsic.NewDERPServerInContainer(...)\nif err != nil {\n    if strings.Contains(err.Error(), \"creating certificates\") {\n        // transient crypto/entropy issue: rerun the helper once\n    }\n    t.Fatalf(\"derp setup: %v\", err)\n}","preventionTips":["Keep integration hosts healthy on entropy (modern kernels rarely block, VMs may)","Pin tailscale versions used by tests so hostname templates stay valid"],"tags":["integration-test","tls","docker","derp"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}