{"record":{"id":"90e3964645c4d098","repo":"ory/hydra","slug":"failed-to-create-certificate-s","errorCode":null,"errorMessage":"failed to create certificate: %s","messagePattern":"failed to create certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":279,"sourceCode":"\t\tIssuer: pkix.Name{\n\t\t\tOrganization: []string{\"ORY GmbH\"},\n\t\t\tCommonName:   \"ORY\",\n\t\t},\n\t\tNotBefore:             time.Now().UTC(),\n\t\tNotAfter:              time.Now().UTC().Add(time.Hour * 24 * 31),\n\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},\n\t\tBasicConstraintsValid: true,\n\t\tIsCA:                  true,\n\t\tDNSNames:              []string{\"localhost\"},\n\t}\n\tfor _, opt := range opts {\n\t\topt(certificate)\n\t}\n\n\tder, err := x509.CreateCertificate(rand.Reader, certificate, certificate, PublicKey(key), key)\n\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to create certificate: %s\", err)\n\t}\n\n\tcert, err = x509.ParseCertificate(der)\n\tif err != nil {\n\t\treturn cert, errors.Errorf(\"failed to encode private key: %s\", err)\n\t}\n\treturn cert, nil\n}\n\n// PEMBlockForKey returns a PEM-encoded block for key.\nfunc PEMBlockForKey(key interface{}) (*pem.Block, error) {\n\tb, err := x509.MarshalPKCS8PrivateKey(key)\n\tif err != nil {\n\t\treturn nil, errors.WithStack(err)\n\t}\n\treturn &pem.Block{Type: \"PRIVATE KEY\", Bytes: b}, nil\n}\n","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L261-L297","documentation":"CreateSelfSignedCertificate calls x509.CreateCertificate to sign the template with the provided key. If the Go standard library rejects the operation — most commonly because the key is not a supported RSA/ECDSA private key or the public/private keys do not match — this error wraps the underlying x509 error. It indicates the key argument passed to the function is invalid for certificate creation.","triggerScenarios":"Passing a key that is not a supported private key type (e.g. an ed25519 key on an old Go version, a *rsa.PublicKey instead of the private key, or a PEM string not yet parsed) into CreateSelfSignedCertificate or GetOrCreateTLSCertificate.","commonSituations":"Loading a key from a file and passing the PEM bytes instead of a parsed key object; using key algorithms unsupported by the Go version; passing a public key where the private key is required.","solutions":["Verify the key is a parsed private key (*rsa.PrivateKey or *ecdsa.PrivateKey) — use PEMBlockForKey/tls helpers or x509.ParsePKCS8PrivateKey to parse PEM first.","Confirm the key type is supported by your Go version (ed25519 requires Go 1.13+).","Ensure the public key embedded in the certificate matches the signing key (the library calls PublicKey(key) for you, so a mismatch usually means the wrong value was passed as key)."],"exampleFix":"// before\ncert, err := tlsx.CreateSelfSignedCertificate(pemBytes) // raw PEM\n// after\nkey, err := x509.ParsePKCS1PrivateKey(pemBytes)\nif err != nil { /* handle */ }\ncert, err := tlsx.CreateSelfSignedCertificate(key)","handlingStrategy":"validation","validationCode":"switch k := key.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:\n    // ok\ndefault:\n    // parse PEM first or reject\n}\n// also verify the key is the private, not public, half","typeGuard":"func isSupportedPrivateKey(key interface{}) bool {\n    switch key.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:\n        return true\n    default:\n        return false\n    }\n}","tryCatchPattern":"cert, err := tlsx.CreateSelfSignedCertificate(key)\nif err != nil && strings.Contains(err.Error(), \"failed to create certificate\") {\n    // key invalid: re-parse PEM into a proper private key and retry\n}","preventionTips":["Always pass a parsed private key (*rsa.PrivateKey / *ecdsa.PrivateKey), never raw PEM bytes.","Check the key algorithm is supported by your Go version (ed25519 needs Go 1.13+).","Keep key generation and certificate creation in the same code path to avoid mismatches."],"tags":["tls","x509","crypto","invalid-key"],"backgroundTag":"x509-certificate-creation-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}