{"record":{"id":"b708f1431863fb4a","repo":"caddyserver/caddy","slug":"generating-root-v","errorCode":null,"errorMessage":"generating root: %v","messagePattern":"generating root: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/caddypki/ca.go","lineNumber":294,"sourceCode":"\nfunc (ca CA) loadOrGenRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {\n\tif ca.Root != nil {\n\t\trootChain, rootSigner, err := ca.Root.Load()\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}\n\t\treturn rootChain[0], rootSigner, nil\n\t}\n\trootCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyRootCert())\n\tif err != nil {\n\t\tif !errors.Is(err, fs.ErrNotExist) {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading root cert: %v\", err)\n\t\t}\n\n\t\t// TODO: should we require that all or none of the assets are required before overwriting anything?\n\t\trootCert, rootKey, err = ca.genRoot()\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"generating root: %v\", err)\n\t\t}\n\t}\n\n\tif rootCert == nil {\n\t\trootCert, err = pemDecodeCertificate(rootCertPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"parsing root certificate PEM: %v\", err)\n\t\t}\n\t}\n\tif rootKey == nil {\n\t\trootKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyRootKey())\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading root key: %v\", err)\n\t\t}\n\t\trootKey, err = certmagic.PEMDecodePrivateKey(rootKeyPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding root key: %v\", err)\n\t\t}","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L276-L312","documentation":"When no root exists yet, Caddy generates one via CA.genRoot (generateRoot creates an ECDSA P-256 root, 24h*3650 by default). Any failure in key generation, self-signing, or the replacer is wrapped as 'generating root'. This path runs only on first use of a CA id, so failure usually indicates an entropy, crypto, or pre-processing problem rather than bad input data.","triggerScenarios":"First startup for a CA id (storage returns fs.ErrNotExist for the root cert) and generateRoot fails: RNG exhaustion on the host, an invalid RootCommonName after replacement producing an unencodable subject, or an OS crypto subsystem failure while generating the ECDSA key or self-signing.","commonSituations":"Containers with depleted/absent entropy during rapid provisioning; exotic architectures where crypto/rand or ecdsa fails; a template in root_common_name that expands to invalid ASN.1 characters.","solutions":["Retry provisioning after ensuring entropy is available (check /proc/sys/kernel/random/entropy_avail, getrandom health); on VMs/containers this often resolves itself after the host is up.","Simplify root_common_name to plain ASCII and retry.","Update Caddy to a current version to pick up crypto-layer fixes.","If it persists, capture the wrapped inner error from logs — it names the exact failing crypto call."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-provisioning check on hosts you control\nb := make([]byte, 32)\nif _, err := rand.Read(b); err != nil { log.Fatal(\"RNG unavailable; fix entropy first\") }","typeGuard":null,"tryCatchPattern":"// first-boot generation can fail transiently on entropy; retry provisioning once\nif err := provisionCA(); err != nil && strings.Contains(err.Error(), \"generating root\") {\n    time.Sleep(time.Second)\n    err = provisionCA()\n}\nif err != nil { return err }","preventionTips":["On VMs/containers, wait for getrandom readiness before starting services that generate keys.","Keep root_common_name as plain ASCII.","Run provisioning steps (first boot) separately from steady-state supervision so retries are cheap."],"tags":["pki","root-cert","crypto","entropy"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}