{"record":{"id":"960bbd0507b95603","repo":"caddyserver/caddy","slug":"generating-ca-intermediate-v","errorCode":null,"errorMessage":"generating CA intermediate: %v","messagePattern":"generating CA intermediate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/caddypki/ca.go","lineNumber":388,"sourceCode":"\t\tinterKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateKey())\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate key: %v\", err)\n\t\t}\n\t\tinterKey, err = certmagic.PEMDecodePrivateKey(interKeyPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate key: %v\", err)\n\t\t}\n\t}\n\n\treturn interCertChain, interKey, nil\n}\n\nfunc (ca CA) genIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCert *x509.Certificate, interKey crypto.Signer, err error) {\n\trepl := ca.newReplacer()\n\n\tinterCert, interKey, err = generateIntermediate(repl.ReplaceAll(ca.IntermediateCommonName, \"\"), rootCert, rootKey, time.Duration(ca.IntermediateLifetime))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"generating CA intermediate: %v\", err)\n\t}\n\tinterCertPEM, err := pemEncodeCert(interCert.Raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding intermediate certificate: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateCert(), interCertPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving intermediate certificate: %v\", err)\n\t}\n\tinterKeyPEM, err := certmagic.PEMEncodePrivateKey(interKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding intermediate key: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateKey(), interKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving intermediate key: %v\", err)\n\t}\n","sourceCodeStart":370,"sourceCodeEnd":406,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L370-L406","documentation":"In CA.genIntermediate, generateIntermediate (signing a new intermediate with the root for IntermediateLifetime) failed and the error is wrapped as 'generating CA intermediate'. This is the same signing step as error 594 but reported from genIntermediate's own call site — it means Caddy could not produce a fresh intermediate at all, blocking leaf issuance.","triggerScenarios":"Intermediate generation path (nothing valid in storage) where generateIntermediate returns an error: root key cannot sign (pair mismatch, unsupported algorithm), RNG/entropy failure, or template/subject error from IntermediateCommonName expansion.","commonSituations":"Imported root whose key does not match the cert; entropy-starved containers at provisioning time; unusual common-name templates; library version regressions.","solutions":["Verify the root cert/key pair matches (compare openssl x509 -pubkey and openssl pkey -pubout).","Ensure host entropy is healthy; retry provisioning.","Use plain ASCII intermediate_common_name.","Upgrade Caddy to current; capture the wrapped inner error for diagnosis if it persists."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pair-check the root before issuance-dependent deployments\nif !pubKeysMatch(rootCert, rootKey) { fail(\"root pair mismatch\") }","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"generating CA intermediate\") {\n    // diagnose root pairing/entropy via wrapped error; retry once after fix\n}","preventionTips":["Validate imported roots' cert/key pairing at install time.","Keep common names ASCII and template-free.","Upgrade Caddy alongside OS/crypto library updates."],"tags":["pki","intermediate","signing","generation"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}