{"record":{"id":"fec7e71c2e64037f","repo":"caddyserver/caddy","slug":"loading-intermediate-cert-v","errorCode":null,"errorMessage":"loading intermediate cert: %v","messagePattern":"loading intermediate cert: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/ca.go","lineNumber":350,"sourceCode":"\t}\n\trootKeyPEM, err := certmagic.PEMEncodePrivateKey(rootKey)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"encoding root key: %v\", err)\n\t}\n\terr = ca.storage.Store(ca.ctx, ca.storageKeyRootKey(), rootKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"saving root key: %v\", err)\n\t}\n\n\treturn rootCert, rootKey, nil\n}\n\nfunc (ca CA) loadOrGenIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCertChain []*x509.Certificate, interKey crypto.Signer, err error) {\n\tvar interCert *x509.Certificate\n\tinterCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateCert())\n\tif err != nil {\n\t\tif !errors.Is(err, fs.ErrNotExist) {\n\t\t\treturn nil, nil, fmt.Errorf(\"loading intermediate cert: %v\", err)\n\t\t}\n\n\t\t// TODO: should we require that all or none of the assets are required before overwriting anything?\n\t\tinterCert, interKey, err = ca.genIntermediate(rootCert, rootKey)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"generating new intermediate cert: %v\", err)\n\t\t}\n\n\t\tinterCertChain = append(interCertChain, interCert)\n\t}\n\n\tif len(interCertChain) == 0 {\n\t\tinterCertChain, err = pemDecodeCertificateChain(interCertPEM)\n\t\tif err != nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"decoding intermediate certificate PEM: %v\", err)\n\t\t}\n\t}\n","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/ca.go#L332-L368","documentation":"CA.loadOrGenIntermediate reads the intermediate certificate PEM from storage (storageKeyIntermediateCert). A non-ErrNotExist error — backend failure, permissions, I/O fault — is wrapped as 'loading intermediate cert'. A clean not-found instead triggers intermediate generation, so this error means storage is present but failing to serve the object.","triggerScenarios":"storage.Load for the intermediate cert errors with something other than fs.ErrNotExist: unreadable file, custom storage backend outage, corrupted storage index. Happens whenever a CA loads an existing intermediate (normal subsequent startups) in the default (non-external-intermediate, non-sign_with_root) configuration.","commonSituations":"Service user lacking read permission on storage/caddy/pki/<id>/ca/intermediate.crt; Redis/consul/S3 briefly down at boot; migrated storage where the object metadata broke.","solutions":["Repair read access to the storage location and confirm the intermediate object is present and readable.","Restore backend connectivity/credentials for custom storage, then restart.","Validate the object is intact (openssl x509 -noout); if corrupt, delete the intermediate cert+key objects only (keep root) so Caddy regenerates the intermediate signed by the existing root.","Point storage at a writable, healthy location if the backend is unreliable."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-start readability check for the intermediate object (skip if absent = OK)\nif _, err := os.ReadFile(caDir + \"/intermediate.crt\"); err != nil && !errors.Is(err, fs.ErrNotExist) {\n    log.Fatalf(\"storage failing for intermediate cert: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"// transient backend failures: one bounded retry, then fail with context\nif strings.Contains(err.Error(), \"loading intermediate cert\") {\n    if err2 := retryOnce(startCaddy, cfg); err2 != nil { return fmt.Errorf(\"storage failing: %w\", err2) }\n}","preventionTips":["Include CA asset reads in storage healthchecks.","Keep the Caddy service user's read permissions intact across system updates.","Use caddy storage export/import for migrations instead of raw object copies."],"tags":["pki","storage","intermediate","io"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}