{"record":{"id":"b61e8abc5b4b84a6","repo":"caddyserver/caddy","slug":"decoding-intermediate-key-v","errorCode":null,"errorMessage":"decoding intermediate key: %v","messagePattern":"decoding intermediate key: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/caddypki/ca.go","lineNumber":376,"sourceCode":"\n\t\tinterCertChain = append(interCertChain, interCert)\n\t}\n\n\tif len(interCertChain) == 0 {\n\t\tinterCertChain, err = pemDecodeCertificateChain(interCertPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate certificate PEM: %v\", err)\n\t\t}\n\t}\n\n\tif interKey == nil {\n\t\tinterKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateKey())\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate key: %v\", err)\n\t\t}\n\t\tinterKey, err = certmagic.PEMDecodePrivateKey(interKeyPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate key: %v\", err)\n\t\t}\n\t}\n\n\treturn interCertChain, interKey, nil\n}\n\nfunc (ca CA) genIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCert *x509.Certificate, interKey crypto.Signer, err error) {\n\trepl := ca.newReplacer()\n\n\tinterCert, interKey, err = generateIntermediate(repl.ReplaceAll(ca.IntermediateCommonName, \"\"), rootCert, rootKey, time.Duration(ca.IntermediateLifetime))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"generating CA intermediate: %v\", err)\n\t}\n\tinterCertPEM, err := pemEncodeCert(interCert.Raw)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding intermediate certificate: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateCert(), interCertPEM)","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L358-L394","documentation":"The intermediate key PEM bytes were loaded from storage, but certmagic.PEMDecodePrivateKey could not decode them into a signer. The stored key is invalid: wrong PEM block type, encrypted key, unsupported format, or corrupted base64. The intermediate chain may be perfectly fine, but signing is impossible without a usable key.","triggerScenarios":"intermediate key object contains an encrypted ('BEGIN ENCRYPTED PRIVATE KEY') or otherwise undecodable PEM, a certificate instead of a key, raw DER, or truncated bytes. Raised in loadOrGenIntermediate after the cert chain loaded successfully.","commonSituations":"Operator replaced the key with an OpenSSL-exported passphrase-protected key; scripts writing DER; truncation after disk-full; copy/paste errors when restoring from backups.","solutions":["Restore a valid, unencrypted PEM private key matching intermediate.crt (validate: openssl pkey -in key.pem -noout; decrypt with openssl pkey first if needed).","If no valid key remains, delete the intermediate cert+key objects and restart so Caddy regenerates the intermediate under the existing root.","Confirm key/cert pairing by comparing public keys.","Keep storage objects untouched by external tooling."],"exampleFix":"# before: encrypted key in storage\n-----BEGIN ENCRYPTED PRIVATE KEY-----...\n# after\nopenssl pkey -in enc.key -out intermediate.key.pem\n-----BEGIN PRIVATE KEY-----...","handlingStrategy":"validation","validationCode":"// Reject undecodable keys before startup\nblock, _ := pem.Decode(interKeyPEM)\nif block == nil || strings.Contains(block.Type, \"ENCRYPTED\") { fail(\"intermediate key must be unencrypted PEM\") }","typeGuard":"func isUsablePrivateKeyPEM(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    if blk == nil || strings.Contains(blk.Type, \"ENCRYPTED\") { return false }\n    _, err := certmagicPEMDecodePrivateKeyMock(b) // or x509.ParsePKCS8PrivateKey etc.\n    return err == nil\n}","tryCatchPattern":"if strings.Contains(err.Error(), \"decoding intermediate key\") {\n    // re-store an unencrypted PEM key matching intermediate.crt, or regenerate intermediate\n}","preventionTips":["Decrypt OpenSSL keys before placing them in Caddy storage.","Validate key files with openssl pkey -noout in deploy pipelines.","Restrict shell access to storage directories to reduce accidental rewrites."],"tags":["pki","intermediate-key","pem","crypto"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}