{"record":{"id":"dea3cd2bfa412d5c","repo":"tailscale/tailscale","slug":"find-identity-w","errorCode":null,"errorMessage":"find identity: %w","messagePattern":"find identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"control/controlclient/sign_supported.go","lineNumber":162,"sourceCode":"\n\tif req.Timestamp == nil {\n\t\treturn errBadRequest\n\t}\n\n\tmachineCertificateSubject := getMachineCertificateSubject(polc)\n\tif machineCertificateSubject == \"\" {\n\t\treturn errCertificateNotConfigured\n\t}\n\n\tst, err := certstore.Open(certstore.System)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"open cert store: %w\", err)\n\t}\n\tdefer st.Close()\n\n\tid, chain, err := findIdentity(machineCertificateSubject, st)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"find identity: %w\", err)\n\t}\n\tdefer id.Close()\n\n\tsigner, err := id.Signer()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create signer: %w\", err)\n\t}\n\n\tcl := 0\n\tfor _, c := range chain {\n\t\tcl += len(c.Raw)\n\t}\n\treq.DeviceCert = make([]byte, 0, cl)\n\tfor _, c := range chain {\n\t\treq.DeviceCert = append(req.DeviceCert, c.Raw...)\n\t}\n\n\treq.SignatureType = tailcfg.SignatureV2","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/control/controlclient/sign_supported.go#L144-L180","documentation":"findIdentity failed while signing a RegisterRequest: either st.Identities() returned an error, or no identity matched — errNoMatch ('no matching certificate'). A match requires an RSA certificate (isSupportedCertificate), currently within its validity window, whose chain (leaf, intermediate, or root) contains a Subject exactly equal to the configured MachineCertificateSubject string.","triggerScenarios":"Policy subject string not matching pkix.Name.String() formatting exactly (wrong ordering, spacing, or missing RDNs); machine cert expired or not yet valid; cert replaced with an ECDSA one; subject configured to match the leaf but only present on a cert not in the store.","commonSituations":"MDM subject copied from docs with different attribute ordering; certs rotated to non-RSA algorithms; expired machine certificates on long-lived devices.","solutions":["Verify MachineCertificateSubject matches the chain's Subject exactly as pkix.Name.String() renders it, including RDN order","Confirm the machine certificate is RSA, present in the system store, and currently valid","Renew expired machine certificates via MDM","Note the subject may match any cert in the chain (leaf, intermediate, or root) — widen the search accordingly"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify subject formatting matches pkix.Name.String() before policy deploy\nwant := \"CN=Tailscale Inc Test Root CA,OU=...,O=...,ST=ON,C=CA\"\nfor _, c := range chain {\n    if c.Subject.String() == want && c.PublicKeyAlgorithm == x509.RSA && now.After(c.NotBefore) && now.Before(c.NotAfter) {\n        return nil // match guaranteed\n    }\n}","typeGuard":"func isNoMatchingCert(err error) bool {\n    return err != nil && strings.HasSuffix(err.Error(), \"no matching certificate\")\n}","tryCatchPattern":null,"preventionTips":["Copy the subject string verbatim from the cert chain as Go renders it (pkix.Name.String())","Keep machine certificates RSA and renew before expiry","Remember the subject can match the leaf, an intermediate, or the root"],"tags":["certificate","mdm","identity-matching","tailscale"],"backgroundTag":"certificate-not-found","analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}