{"record":{"id":"ff9dafa1665d4ebf","repo":"cloudflare/cloudflared","slug":"failed-to-send-request","errorCode":null,"errorMessage":"failed to send request","messagePattern":"failed to send request","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sshgen/sshgen.go","lineNumber":123,"sourceCode":"\t\tPublicKey: pubKey,\n\t\tJWT:       token,\n\t\tIssuer:    claims.Issuer,\n\t})\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to marshal signPayload\")\n\t}\n\tvar res *http.Response\n\tif mockRequest != nil {\n\t\tres, err = mockRequest(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t} else {\n\t\tclient := http.Client{\n\t\t\tTimeout: 10 * time.Second,\n\t\t}\n\t\tres, err = client.Post(claims.Issuer+signEndpoint, \"application/json\", bytes.NewBuffer(buf))\n\t}\n\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to send request\")\n\t}\n\tdefer res.Body.Close()\n\n\tdecoder := json.NewDecoder(res.Body)\n\n\tif res.StatusCode != 200 {\n\t\tvar errResponse errorResponse\n\t\tif err := decoder.Decode(&errResponse); err != nil {\n\t\t\treturn \"\", err\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"%d: %s\", errResponse.Status, errResponse.Message)\n\t}\n\n\tvar signRes signResponse\n\tif err := decoder.Decode(&signRes); err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to decode HTTP response\")\n\t}\n\treturn signRes.Certificate, nil","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/sshgen/sshgen.go#L105-L141","documentation":"SignCert POSTs the marshalled payload to the issuer URL (claims.Issuer + /cdn-cgi/access/cert_sign) with a 10-second HTTP client timeout. This error wraps any transport-level failure of that request: DNS failure, connection refused, TLS errors, or the timeout.","triggerScenarios":"client.Post fails because the issuer host is unreachable, DNS does not resolve, the network is down, TLS handshake fails, or the 10s timeout elapses.","commonSituations":"No internet/VPN connectivity; issuer URL misconfigured in the Access token; corporate proxy blocking the endpoint; slow network exceeding the 10s timeout.","solutions":["Check network connectivity and that the issuer hostname resolves (dig/nslookup)","Confirm the issuer URL in the JWT is the correct Cloudflare Access domain","Increase or verify the 10s timeout is sufficient for your network (edit sshgen.go client Timeout)","Check corporate proxies/firewalls that may block POSTs to the sign endpoint"],"exampleFix":"// before\nclient := http.Client{Timeout: 10 * time.Second}\n// after\nclient := http.Client{Timeout: 30 * time.Second}","handlingStrategy":"retry","validationCode":"// check the issuer endpoint is reachable before signing\nu, err := url.Parse(issuer)\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid issuer URL: %q\", issuer)\n}\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(u.Hostname(), portOr(u, \"443\")), 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"issuer unreachable: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"cert, err := SignCert(token, pubKey)\nif err != nil && strings.Contains(err.Error(), \"failed to send request\") {\n    // retry with backoff for transient network issues\n    time.Sleep(2 * time.Second)\n    cert, err = SignCert(token, pubKey)\n}","preventionTips":["Check DNS and outbound HTTPS access before signing","Allow the issuer domain through proxies/firewalls","Keep the 10s client timeout in mind on slow links and raise it if needed"],"tags":["network","http","ssh"],"backgroundTag":"http-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}