{"record":{"id":"c006184f439691e4","repo":"kgretzky/evilginx2","slug":"failed-to-get-tls-certificate-for-s-d-error-s","errorCode":null,"errorMessage":"failed to get TLS certificate for: %s:%d error: %s","messagePattern":"failed to get TLS certificate for: (.+?):(.+?) error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/certdb.go","lineNumber":308,"sourceCode":"\t\t\treturn nil, err\n\t\t}\n\n\t\ttemplate = x509.Certificate{\n\t\t\tSerialNumber:          serialNumber,\n\t\t\tIssuer:                x509ca.Subject,\n\t\t\tSubject:               pkix.Name{Organization: []string{\"Evilginx Signature Trust Co.\"}},\n\t\t\tNotBefore:             time.Now(),\n\t\t\tNotAfter:              time.Now().Add(time.Hour * 24 * 180),\n\t\t\tKeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,\n\t\t\tExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},\n\t\t\tDNSNames:              []string{host},\n\t\t\tBasicConstraintsValid: true,\n\t\t}\n\t\ttemplate.Subject.CommonName = host\n\t} else {\n\t\tsrvCert, err := o.getTLSCertificate(host, port)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to get TLS certificate for: %s:%d error: %s\", host, port, err)\n\t\t} else {\n\t\t\tserialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)\n\t\t\tserialNumber, err := rand.Int(rand.Reader, serialNumberLimit)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\ttemplate = x509.Certificate{\n\t\t\t\tSerialNumber:          serialNumber,\n\t\t\t\tIssuer:                x509ca.Subject,\n\t\t\t\tSubject:               srvCert.Subject,\n\t\t\t\tNotBefore:             srvCert.NotBefore,\n\t\t\t\tNotAfter:              time.Now().Add(time.Hour * 24 * 180),\n\t\t\t\tKeyUsage:              srvCert.KeyUsage,\n\t\t\t\tExtKeyUsage:           srvCert.ExtKeyUsage,\n\t\t\t\tIPAddresses:           srvCert.IPAddresses,\n\t\t\t\tDNSNames:              []string{phish_host},\n\t\t\t\tBasicConstraintsValid: true,","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/kgretzky/evilginx2/blob/4c0988a1d9db4d172a185e979a38bfd0efdb5830/core/certdb.go#L290-L326","documentation":"getSelfSignedCertificate wraps failures from getTLSCertificate in this error when the host is not the local/loopback case (so a managed certificate must be fetched for host:port). The underlying reason (TLS dial error, certificate not found/managed, etc.) is embedded in the %s at the end. Callers of the certificate lookup (anonymous closure, e.g. the TLS config callback) receive nil cert and this error.","triggerScenarios":"Requesting a TLS certificate for a host whose certificate is not cached/managed and the TLS connection to host:port fails — wrong port, host not proxied/enabled in phishlets, network unreachable, or upstream presents an unusable certificate.","commonSituations":"Misconfigured phishlet hostname that doesn't resolve; upstream server offline or blocking; testing against hosts not defined in any phishlet; DNS failures in containers; wrong port in the host:port pair.","solutions":["Check the embedded error text (after 'error:') to see the root cause and fix that first","Verify the host is configured and enabled in the relevant phishlet so its certificate is managed/cached","Confirm host:port is correct and reachable (dig/nslookup, curl -v https://host:port)","Pre-generate the certificate for the host or fall back to self-signed generation"],"exampleFix":"// before\ngetSelfSignedCertificate(\"api.phish.example.com\", 443) // host not in any enabled phishlet\n// after\nphishlets hostname myphishlet api.phish.example.com\nphishlets enable myphishlet\n# now the cert for api.phish.example.com is managed and retrievable","handlingStrategy":"try-catch","validationCode":"// before requesting, confirm the host is managed and reachable\naddr := fmt.Sprintf(\"%s:%d\", host, port)\nif _, err := net.LookupHost(host); err != nil { log.Printf(\"host %s unresolvable\", host) }\nif c, err := tls.Dial(\"tcp\", addr, &tls.Config{InsecureSkipVerify: true}); err == nil { c.Close() } else { log.Printf(\"TLS unreachable: %v\", err) }","typeGuard":null,"tryCatchPattern":"cert, err := db.getSelfSignedCertificate(host, port)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"failed to get TLS certificate for:\") {\n        log.Printf(\"cert fetch failed for %s:%d — check phishlet hostname config and upstream: %v\", host, port, err)\n    }\n    return nil, err\n}","preventionTips":["Set and enable the phishlet hostname before traffic flows","Verify host DNS and upstream port reachability","Keep certificates cached/pre-provisioned for proxied hosts","Read the wrapped error text for the root cause before retrying"],"tags":["tls","network","certificate"],"backgroundTag":"tls-certificate-not-found","analyzedSha":"4c0988a1d9db4d172a185e979a38bfd0efdb5830","analyzedAt":"2026-09-05T19:23:07.238Z","contentChangedAt":"2026-09-05T19:23:07.238Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}