{"record":{"id":"e2d8c64eb089fdae","repo":"caddyserver/caddy","slug":"generating-new-intermediate-cert-v","errorCode":null,"errorMessage":"generating new intermediate cert: %v","messagePattern":"generating new intermediate cert: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/caddypki/ca.go","lineNumber":356,"sourceCode":"\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving root key: %v\", err)\n\t}\n\n\treturn rootCert, rootKey, nil\n}\n\nfunc (ca CA) loadOrGenIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCertChain []*x509.Certificate, interKey crypto.Signer, err error) {\n\tvar interCert *x509.Certificate\n\tinterCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateCert())\n\tif err != nil {\n\t\tif !errors.Is(err, fs.ErrNotExist) {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate cert: %v\", err)\n\t\t}\n\n\t\t// TODO: should we require that all or none of the assets are required before overwriting anything?\n\t\tinterCert, interKey, err = ca.genIntermediate(rootCert, rootKey)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"generating new intermediate cert: %v\", err)\n\t\t}\n\n\t\tinterCertChain = append(interCertChain, interCert)\n\t}\n\n\tif len(interCertChain) == 0 {\n\t\tinterCertChain, err = pemDecodeCertificateChain(interCertPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate certificate PEM: %v\", err)\n\t\t}\n\t}\n\n\tif interKey == nil {\n\t\tinterKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateKey())\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate key: %v\", err)\n\t\t}\n\t\tinterKey, err = certmagic.PEMDecodePrivateKey(interKeyPEM)","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L338-L374","documentation":"When no intermediate exists in storage, Caddy generates one: CA.genIntermediate has generateIntermediate sign a new intermediate cert with the root (lifetime = IntermediateLifetime, forced below root remaining lifetime by the check at ca.go:172). Any failure in that signing path is wrapped as 'generating new intermediate cert'. This blocks leaf-certificate issuance entirely, since leafs are signed by the intermediate by default.","triggerScenarios":"First use of a CA (no intermediate in storage) and generateIntermediate fails: root key unusable for signing, entropy/RNG failure, x509 template error (IntermediateCommonName expansion), or an internal smallstep error while signing with the root.","commonSituations":"Entropy-starved containers during provisioning; an imported root whose key algorithm mismatches its cert; odd characters/templates in intermediate_common_name; version regressions in the bundled step-ca library.","solutions":["Ensure entropy availability and retry provisioning.","Check the root cert/key pair actually matches (openssl pubkey comparison) — a mismatch can make signing fail.","Use plain ASCII for intermediate_common_name.","Upgrade Caddy; if it persists, capture the wrapped inner error (it names the exact signing step) and report upstream."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Before relying on a CA for issuance, verify its root can sign: pair check\nif !pubKeysMatch(rootCert, rootKey) { fail(\"root pair mismatch; cannot generate intermediate\") }","typeGuard":"func pubKeysMatch(cert *x509.Certificate, key crypto.Signer) bool {\n    return cert.PublicKey.(interface{ Equal(crypto.PublicKey) bool }).Equal(key.Public())\n}","tryCatchPattern":"if strings.Contains(err.Error(), \"generating new intermediate cert\") {\n    // check root pairing + entropy, retry once; keep leaf issuance disabled meanwhile\n}","preventionTips":["Validate imported root pairs before first issuance.","Ensure entropy availability during provisioning windows.","Use simple ASCII intermediate_common_name values."],"tags":["pki","intermediate","signing","crypto"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}