{"record":{"id":"f6033d050f3de67b","repo":"coollabsio/coolify","slug":"failed-to-generate-private-key-openssl-error-str","errorCode":null,"errorMessage":"Failed to generate private key: {openssl_error_string()}","messagePattern":"Failed to generate private key: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":42,"sourceCode":"        ?string $caCert = null,\n        ?string $caKey = null,\n        bool $isCaCertificate = false,\n        ?string $configurationDir = null,\n        ?string $mountPath = null,\n        bool $isPemKeyFileRequired = false,\n    ): SslCertificate {\n        $organizationName = self::DEFAULT_ORGANIZATION_NAME;\n        $countryName = self::DEFAULT_COUNTRY_NAME;\n        $stateName = self::DEFAULT_STATE_NAME;\n\n        try {\n            $privateKey = openssl_pkey_new([\n                'private_key_type' => OPENSSL_KEYTYPE_EC,\n                'curve_name' => 'secp521r1',\n            ]);\n\n            if ($privateKey === false) {\n                throw new \\RuntimeException('Failed to generate private key: '.openssl_error_string());\n            }\n\n            if (! openssl_pkey_export($privateKey, $privateKeyStr)) {\n                throw new \\RuntimeException('Failed to export private key: '.openssl_error_string());\n            }\n\n            if (! is_null($serverId) && ! $isCaCertificate) {\n                $server = Server::find($serverId);\n                if ($server) {\n                    $ip = $server->getIp;\n                    if ($ip) {\n                        $type = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6)\n                            ? 'IP'\n                            : 'DNS';\n                        $subjectAlternativeNames = array_unique(\n                            array_merge($subjectAlternativeNames, [\"$type:$ip\"])\n                        );\n                    }","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L24-L60","documentation":"SslHelper::generateSslCertificate() calls openssl_pkey_new() requesting an EC key on curve secp521r1; the function returned false, meaning PHP's OpenSSL layer could not create the key. Typical causes: the OpenSSL extension is missing or misbuilt, no readable openssl.cnf (required even for key generation in many builds), or the OpenSSL build lacks EC/secp521r1 support. The appended openssl_error_string() output is the real diagnosis.","triggerScenarios":"Generating any SSL certificate (app/service certificates, CA certificates) on a host where PHP has no OpenSSL extension, an invalid OPENSSL_CONF path, or a restricted OpenSSL (e.g., FIPS-mode or stripped distro/container builds).","commonSituations":"Slim Docker images (alpine/distroless) that ship no openssl.cnf; php:*-cli variants compiled --without-openssl; OPENSSL_CONF env var pointing to a deleted file; hardened/FIPS systems disabling non-approved curves.","solutions":["Verify the extension: run php -m | grep openssl and check php -i | grep openssl.cnf shows a real, readable file.","In Docker images, install openssl and ensure the default openssl.cnf is present (e.g. apk add openssl / apt-get install openssl) or set OPENSSL_CONF to a valid config.","Read the appended openssl_error_string() — 'error:0E06D06C:...NCONF_get_string' points to config-file problems, 'unsupported curve' points to a restricted OpenSSL build.","On FIPS/hardened hosts, enable an EC-capable OpenSSL or relax policy for secp521r1."],"exampleFix":"// before: certificate generation throws on hosts without usable OpenSSL config\n$cert = SslHelper::generateSslCertificate($commonName);\n\n// after: probe OpenSSL availability once and fail with a clear message\nif (! extension_loaded('openssl')) {\n    throw new RuntimeException('OpenSSL extension is required for certificate generation.');\n}\nif (openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_EC, 'curve_name' => 'secp521r1']) === false) {\n    throw new RuntimeException('OpenSSL cannot create secp521r1 keys: '.openssl_error_string());\n}","handlingStrategy":"try-catch","validationCode":"// Environment pre-flight before any certificate generation\nif (! extension_loaded('openssl')) {\n    throw new RuntimeException('The openssl extension is not loaded.');\n}\n$probe = @openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_EC, 'curve_name' => 'secp521r1']);\nif ($probe === false) {\n    throw new RuntimeException('OpenSSL EC/secp521r1 unavailable: '.openssl_error_string());\n}\nopenssl_free_key($probe);","typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName, $sans);\n} catch (\\RuntimeException $e) {\n    if (str_starts_with($e->getMessage(), 'Failed to generate private key')) {\n        // environment problem: log openssl_error_string, do not retry on this host\n        report('OpenSSL key generation failed: '.$e->getMessage());\n        return null;\n    }\n    throw $e;\n}","preventionTips":["Bake a valid openssl.cnf into deployment images and set OPENSSL_CONF explicitly.","Add an install/health check that runs openssl_pkey_new once at startup.","Watch for this after PHP/OpenSSL upgrades or base-image switches — EC support can silently change."],"tags":["ssl","openssl","ec-key","php","key-generation"],"backgroundTag":"openssl-key-generation-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}