{"record":{"id":"adf0f7495f464c22","repo":"router-for-me/CLIProxyAPI","slug":"home-certificate-request-returned-nil","errorCode":null,"errorMessage":"home certificate request returned nil","messagePattern":"home certificate request returned nil","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/home/certificate.go","lineNumber":366,"sourceCode":"}\n\nfunc readRESPBulk(reader *bufio.Reader) ([]byte, error) {\n\tprefix, errRead := reader.ReadByte()\n\tif errRead != nil {\n\t\treturn nil, errRead\n\t}\n\tswitch prefix {\n\tcase '$':\n\t\tline, errLine := reader.ReadString('\\n')\n\t\tif errLine != nil {\n\t\t\treturn nil, errLine\n\t\t}\n\t\tsize, errSize := strconv.Atoi(strings.TrimSpace(line))\n\t\tif errSize != nil {\n\t\t\treturn nil, errSize\n\t\t}\n\t\tif size < 0 {\n\t\t\treturn nil, fmt.Errorf(\"home certificate request returned nil\")\n\t\t}\n\t\tpayload := make([]byte, size+2)\n\t\tif _, errFull := io.ReadFull(reader, payload); errFull != nil {\n\t\t\treturn nil, errFull\n\t\t}\n\t\treturn payload[:size], nil\n\tcase '-':\n\t\tline, errLine := reader.ReadString('\\n')\n\t\tif errLine != nil {\n\t\t\treturn nil, errLine\n\t\t}\n\t\treturn nil, fmt.Errorf(\"%s\", strings.TrimSpace(line))\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"home certificate request returned unsupported resp prefix %q\", prefix)\n\t}\n}\n\nfunc fileExists(path string) bool {","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/home/certificate.go#L348-L384","documentation":"Returned by readRESPBulk in internal/home/certificate.go while parsing the home server's RESP reply: the reply started with '$' (bulk string) but the declared size parsed to a negative number. In RESP, $-1 is the canonical nil bulk reply, so this means the server answered 'nil' — typically because the requested key/enrollment record does not exist on that node.","triggerScenarios":"Sending CERTIFICATE REQUEST (or any bulk-string request) to a home/Redis node that has no record of the item — e.g. certificate ID unknown, data not yet replicated to the node you reached, or a misrouted connection to a bare Redis instance without the home schema.","commonSituations":"Enrollment secret/certificate entry not yet propagated to the queried replica; pointing the client at the wrong host:port (a plain Redis, not the home server); the enrollment record expired on the server.","solutions":["Confirm you are connecting to the correct home server address/port from the config","Retry against the primary node or wait for replication if you hit a replica","Re-register the certificate ID / enrollment secret on the server so the record exists"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"home certificate request returned nil\") {\n    // nil bulk reply: record absent on this node; retry against primary or after re-registration\n    time.Sleep(time.Second)\n    return requestCertificate(ctx, csrPEM) // bounded retry\n}","preventionTips":["Direct enrollment traffic at the home primary node, not replicas","Register the enrollment record before clients start requesting certificates"],"tags":["go","resp","enrollment","protocol","home"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}