{"record":{"id":"b0fb178eae5a5fab","repo":"caddyserver/caddy","slug":"private-key-does-not-match-issuer-public-key","errorCode":null,"errorMessage":"private key does not match issuer public key","messagePattern":"private key does not match issuer public key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/crypto.go","lineNumber":135,"sourceCode":"\n\t\treturn chain, key, nil\n\n\tdefault:\n\t\treturn nil, nil, fmt.Errorf(\"unsupported format: %s\", kp.Format)\n\t}\n}\n\n// verifyKeysMatch verifies that the public key in the [x509.Certificate] matches\n// the public key of the [crypto.Signer].\nfunc verifyKeysMatch(crt *x509.Certificate, signer crypto.Signer) error {\n\tswitch pub := crt.PublicKey.(type) {\n\tcase *rsa.PublicKey:\n\t\tpk, ok := signer.Public().(*rsa.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tcase *ecdsa.PublicKey:\n\t\tpk, ok := signer.Public().(*ecdsa.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tcase ed25519.PublicKey:\n\t\tpk, ok := signer.Public().(ed25519.PublicKey)\n\t\tif !ok {\n\t\t\treturn fmt.Errorf(\"private key type %T does not match issuer public key type %T\", signer.Public(), pub)\n\t\t}\n\t\tif !pub.Equal(pk) {\n\t\t\treturn errors.New(\"private key does not match issuer public key\")\n\t\t}\n\tdefault:","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/crypto.go#L117-L153","documentation":"meta.json loaded but json.Unmarshal into echConfigMeta failed — the metadata is present but not valid JSON of the expected shape. Caddy's policy is to reset the whole config folder (it cannot reliably maintain a config without metadata), and that cleanup delete failed as well.","triggerScenarios":"json.Unmarshal of non-empty metaBytes errors (truncated JSON from an interrupted write, manual edits, schema change across versions) AND storage.Delete of the config folder errors (read-only/outage).","commonSituations":"Crash during a metadata Store leaving a truncated meta.json; storage backends without atomic writes; mixed-version clusters where the metadata schema evolved; combined with a storage backend that cannot delete.","solutions":["Restore writable storage so the cleanup can proceed.","Manually delete the affected ech/configs/<id> folder (or the whole ech/configs tree if several configs are affected) and restart Caddy to regenerate.","Verify storage health (fsync/atomicity) if truncation recurs; prefer the default file storage or a backend with atomic puts.","Avoid hand-editing files under Caddy's storage."],"exampleFix":"# before: truncated metadata blocks cleanup on read-only storage\n# after: remount writable, then reset the folder\nmount -o remount,rw /var/lib/caddy\nrm -rf /var/lib/caddy/ech/configs/42\nsystemctl restart caddy","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"On JSON-decode failure, Caddy's fallback is folder reset; it only errors when that reset fails — restore storage writability, remove the named ech/configs/<id> folder (or the whole tree), restart.","preventionTips":["Use storage with atomic puts (temp file + rename) so meta.json is never truncated.","Gracefully stop Caddy (SIGTERM) so metadata writes complete.","After crashes, run a startup validation pass; reset ech state if decode errors recur."],"tags":["caddy","caddytls","ech","storage","json","corruption","cleanup"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}