{"record":{"id":"a98506f86efffa8f","repo":"caddyserver/caddy","slug":"encoding-intermediate-certificate-v","errorCode":null,"errorMessage":"encoding intermediate certificate: %v","messagePattern":"encoding intermediate certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/ca.go","lineNumber":392,"sourceCode":"\t\tinterKey, err = certmagic.PEMDecodePrivateKey(interKeyPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate key: %v\", err)\n\t\t}\n\t}\n\n\treturn interCertChain, interKey, nil\n}\n\nfunc (ca CA) genIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCert *x509.Certificate, interKey crypto.Signer, err error) {\n\trepl := ca.newReplacer()\n\n\tinterCert, interKey, err = generateIntermediate(repl.ReplaceAll(ca.IntermediateCommonName, \"\"), rootCert, rootKey, time.Duration(ca.IntermediateLifetime))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"generating CA intermediate: %v\", err)\n\t}\n\tinterCertPEM, err := pemEncodeCert(interCert.Raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding intermediate certificate: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateCert(), interCertPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving intermediate certificate: %v\", err)\n\t}\n\tinterKeyPEM, err := certmagic.PEMEncodePrivateKey(interKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding intermediate key: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateKey(), interKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving intermediate key: %v\", err)\n\t}\n\n\treturn interCert, interKey, nil\n}\n\nfunc (ca CA) storageKeyCAPrefix() string {","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L374-L410","documentation":"After generating a new intermediate certificate, Caddy PEM-encodes it (pemEncodeCert on interCert.Raw) before storing; failure is wrapped as 'encoding intermediate certificate'. Like the root-side encoding errors, this indicates the produced certificate failed PEM serialization — an internal invariant break or abnormal certificate content, not an environment problem.","triggerScenarios":"genIntermediate's freshly signed intermediate has Raw bytes that pemEncodeCert rejects (empty/malformed DER from an upstream signing fault). Only reachable when an intermediate was just generated because none existed in storage.","commonSituations":"Very rare on stock builds; associated with forks injecting custom signers, corrupted library builds, or upstream smallstep/Go x509 regressions.","solutions":["Run a current, unmodified Caddy build.","Retry provisioning once to exclude transient faults.","If reproducible, capture the wrapped error and CA config and report upstream; as a workaround, supply a pre-made intermediate via the intermediate{ cert/key } block."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// internal invariant: capture wrapped error, retry once, report upstream if repeated\nif strings.Contains(err.Error(), \"encoding intermediate certificate\") {\n    logErrorWithConfig(err, caConfig) // workaround: supply external intermediate{cert,key}\n}","preventionTips":["Run current stable releases for PKI components.","Keep a pre-made intermediate cert/key pair available as a fallback via the intermediate{} block.","Archive provisioning logs to capture rare serialization faults."],"tags":["pki","intermediate","pem","encoding"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}