{"record":{"id":"bcb4b9484955f2ed","repo":"argoproj/argo-workflows","slug":"failed-to-generate-serial-number-w","errorCode":null,"errorMessage":"failed to generate serial number: %w","messagePattern":"failed to generate serial number: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"util/tls/tls.go","lineNumber":62,"sourceCode":"\t}\n}\n\nfunc generate() ([]byte, crypto.PrivateKey, error) {\n\thosts := []string{\"localhost\"}\n\n\tvar err error\n\tprivateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to generate private key: %w\", err)\n\t}\n\n\tnotBefore := time.Now()\n\tnotAfter := notBefore.Add(365 * 24 * time.Hour)\n\n\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\tserialNumber, err := rand.Int(rand.Reader, serialNumberLimit)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed to generate serial number: %w\", err)\n\t}\n\n\ttemplate := x509.Certificate{\n\t\tSerialNumber: serialNumber,\n\t\tSubject: pkix.Name{\n\t\t\tOrganization: []string{\"ArgoProj\"},\n\t\t},\n\t\tNotBefore: notBefore,\n\t\tNotAfter:  notAfter,\n\n\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,\n\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},\n\t\tBasicConstraintsValid: true,\n\t}\n\n\tfor _, h := range hosts {\n\t\tif ip := net.ParseIP(h); ip != nil {\n\t\t\ttemplate.IPAddresses = append(template.IPAddresses, ip)","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/tls/tls.go#L44-L80","documentation":"Argo Workflows' internal self-signed cert generator (util/tls) failed to draw a random serial number for the new X.509 certificate using crypto/rand. rand.Int only fails when the system CSPRNG is unavailable, so this error almost always indicates a broken entropy source in the environment running the argo server, not a code or config problem.","triggerScenarios":"Calling GenerateX509KeyPair/GenerateX509KeyPairTLSConfig (which invoke generate via generatePEM) when rand.Int(rand.Reader, serialNumberLimit) returns an error — e.g. /dev/urandom unavailable or blocked, running in a sandbox/container with no entropy source, or a corrupted crypto/rand reader.","commonSituations":"Rare; seen on stripped-down containers lacking entropy, restricted seccomp profiles blocking getrandom(2), or exotic OS environments where the RNG fails at process start.","solutions":["Fix the entropy source in the environment (ensure /dev/urandom is accessible and getrandom(2) is permitted by the container/seccomp profile)","Restart the process — the failure is typically transient if the RNG recovers","If it persists, check the OS kernel RNG state and host virtualization entropy settings","Update Argo Workflows if your platform has a known crypto/rand issue"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure the OS RNG is readable before generating certs\nif f, err := os.Open(\"/dev/urandom\"); err != nil { return fmt.Errorf(\"no entropy source: %w\", err) } else { f.Close() }","typeGuard":null,"tryCatchPattern":"err := tls.GenerateX509KeyPair()\nif err != nil {\n    if strings.Contains(err.Error(), \"serial number\") {\n        // entropy issue: retry after checking /dev/urandom\n        return retryAfterEntropyCheck(err)\n    }\n    return err\n}","preventionTips":["Run containers with access to /dev/urandom and getrandom(2) allowed","Don't disable kernel RNG or run under seccomp profiles that block getrandom","Prefer supplying certs via a Kubernetes TLS secret instead of self-signed generation in hardened environments"],"tags":["tls","crypto","entropy","self-signed-certificate"],"backgroundTag":"crypto-random-source-failure","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}