{"record":{"id":"c81574dfb596d0d5","repo":"coollabsio/coolify","slug":"failed-to-generate-csr-openssl-error-string","errorCode":null,"errorMessage":"Failed to generate CSR: {openssl_error_string()}","messagePattern":"Failed to generate CSR: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":131,"sourceCode":"            CONF;\n\n            $tempConfig = tmpfile();\n            fwrite($tempConfig, $config);\n            $tempConfigPath = stream_get_meta_data($tempConfig)['uri'];\n\n            $csr = openssl_csr_new([\n                'commonName' => $commonName,\n                'organizationName' => $organizationName,\n                'countryName' => $countryName,\n                'stateOrProvinceName' => $stateName,\n            ], $privateKey, [\n                'digest_alg' => 'sha512',\n                'config' => $tempConfigPath,\n                'req_extensions' => 'req_ext',\n            ]);\n\n            if ($csr === false) {\n                throw new \\RuntimeException('Failed to generate CSR: '.openssl_error_string());\n            }\n\n            $certificate = openssl_csr_sign(\n                $csr,\n                $caCert ?? null,\n                $caKey ?? $privateKey,\n                $validityDays,\n                [\n                    'digest_alg' => 'sha512',\n                    'config' => $tempConfigPath,\n                    'x509_extensions' => 'v3_req',\n                ],\n                random_int(1, PHP_INT_MAX)\n            );\n\n            if ($certificate === false) {\n                throw new \\RuntimeException('Failed to sign certificate: '.openssl_error_string());\n            }","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L113-L149","documentation":"openssl_csr_new() returned false while building the certificate signing request with the subject (CN/O/C/ST) and SAN/extension sections written to a temporary OpenSSL config file. Failure means the temp config could not be written/read, its extension syntax is invalid, or the key resource is unusable. openssl_error_string() in the message names the failing routine.","triggerScenarios":"Certificate generation where the temp config file (tempConfigPath) failed to be created (full /tmp, wrong permissions), or the generated openssl.cnf extension blocks (req_ext/v3_req) are rejected by the OpenSSL build in use.","commonSituations":"Containers with a read-only or full /tmp; SELinux/AppArmor denying reads of the temp file; older OpenSSL versions rejecting certain SAN formatting; disk exhaustion during certificate issuance.","solutions":["Check the appended openssl_error_string() — config-parse errors point at the generated temp config, key errors at the key step.","Ensure /tmp is writable and has space in the environment running Coolify/this code.","Upgrade the OpenSSL/PHP build if the error mentions unsupported extension syntax."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Ensure temp config prerequisites before generation\n$tempConfigPath = tempnam(sys_get_temp_dir(), 'openssl');\nif ($tempConfigPath === false || ! is_writable($tempConfigPath)) {\n    throw new RuntimeException('Cannot write OpenSSL temp config in '.sys_get_temp_dir());\n}","typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName);\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), 'Failed to generate CSR')) {\n        report('CSR generation failed: '.$e->getMessage()); // includes openssl_error_string()\n        return null;\n    }\n    throw $e;\n}","preventionTips":["Keep /tmp writable and monitored for space in the runtime environment.","Pin known-good OpenSSL versions in base images; re-test after upgrades.","Log openssl_error_string() whenever surfacing these failures — it names the failing config routine."],"tags":["ssl","openssl","csr","php"],"backgroundTag":"openssl-csr-generation-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}