{"record":{"id":"f6f46bb4b929a644","repo":"coollabsio/coolify","slug":"failed-to-sign-certificate-openssl-error-string","errorCode":null,"errorMessage":"Failed to sign certificate: {openssl_error_string()}","messagePattern":"Failed to sign certificate: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"app/Helpers/SslHelper.php","lineNumber":148,"sourceCode":"            if ($csr === false) {\n                throw new \\RuntimeException('Failed to generate CSR: '.openssl_error_string());\n            }\n\n            $certificate = openssl_csr_sign(\n                $csr,\n                $caCert ?? null,\n                $caKey ?? $privateKey,\n                $validityDays,\n                [\n                    'digest_alg' => 'sha512',\n                    'config' => $tempConfigPath,\n                    'x509_extensions' => 'v3_req',\n                ],\n                random_int(1, PHP_INT_MAX)\n            );\n\n            if ($certificate === false) {\n                throw new \\RuntimeException('Failed to sign certificate: '.openssl_error_string());\n            }\n\n            if (! openssl_x509_export($certificate, $certificateStr)) {\n                throw new \\RuntimeException('Failed to export certificate: '.openssl_error_string());\n            }\n\n            SslCertificate::query()\n                ->where('resource_type', $resourceType)\n                ->where('resource_id', $resourceId)\n                ->where('server_id', $serverId)\n                ->delete();\n\n            $sslCertificate = SslCertificate::create([\n                'ssl_certificate' => $certificateStr,\n                'ssl_private_key' => $privateKeyStr,\n                'resource_type' => $resourceType,\n                'resource_id' => $resourceId,\n                'server_id' => $serverId,","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/coollabsio/coolify/blob/70b9acc42467278373e00de77abb40684e25b395/app/Helpers/SslHelper.php#L130-L166","documentation":"openssl_csr_sign() returned false: the CSR could not be signed with sha512 and the v3_req extension section. When $caCert/$caKey are provided (leaf certificates signed by a generated CA), a mismatched or malformed CA certificate/key pair is the most common cause; otherwise the failure is in the OpenSSL config or digest/extension handling.","triggerScenarios":"Generating a leaf certificate where the stored CA certificate does not match the CA private key; corrupted CA key PEM; an OpenSSL build that rejects sha512 or the v3_req extensions written to the temp config.","commonSituations":"CA key pair rotated on one side only (cert updated, key stale or vice versa); CA certificate data truncated in the database; FIPS-mode OpenSSL disallowing sha512 with certain key types.","solutions":["If signing with a CA: regenerate the CA certificate and key together so the pair matches, then reissue the leaf certificate.","Verify the CA inputs parse: openssl x509 -in ca.pem -noout and openssl pkey -in ca.key -check.","Read openssl_error_string() — key mismatch errors name the CA key explicitly.","On restricted hosts, confirm sha512 is permitted by security policy."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate CA inputs parse as a matching pair before requesting a signed cert\n$caCertRes = openssl_x509_read($caCert);\n$caKeyRes = openssl_pkey_get_private($caKey);\nif ($caCertRes === false || $caKeyRes === false) {\n    throw new RuntimeException('CA certificate or key unreadable: '.openssl_error_string());\n}\nif (! openssl_x509_check_private_key($caCertRes, $caKeyRes)) {\n    throw new RuntimeException('CA certificate does not match CA private key.');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $cert = SslHelper::generateSslCertificate($commonName, caCert: $caCert, caKey: $caKey);\n} catch (\\RuntimeException $e) {\n    if (str_contains($e->getMessage(), 'Failed to sign certificate')) {\n        // most often a CA cert/key mismatch — regenerate the pair together\n        report('Certificate signing failed: '.$e->getMessage());\n        return null;\n    }\n    throw $e;\n}","preventionTips":["Always create and store CA certificate + key as one unit; never rotate one side alone.","Run openssl x509 -checkend / openssl pkey -check health checks on stored CA material.","Verify CA inputs with openssl_x509_check_private_key() before any signing flow."],"tags":["ssl","openssl","certificate-signing","ca","php"],"backgroundTag":"openssl-certificate-signing-failed","analyzedSha":"70b9acc42467278373e00de77abb40684e25b395","analyzedAt":"2026-08-17T01:41:01.313Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}