argoproj/argo-workflows · critical

failed to create certificate: %w

Error message

failed to create certificate: %w

What it means

The call to x509.CreateCertificate failed while building Argo's self-signed TLS certificate (localhost, ECDSA P-256 key). The template and keys are constructed internally by the library, so this indicates the crypto library rejected the certificate construction or the private key, not user configuration.

Source

Thrown at util/tls/tls.go:88

		NotBefore: notBefore,
		NotAfter:  notAfter,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	for _, h := range hosts {
		if ip := net.ParseIP(h); ip != nil {
			template.IPAddresses = append(template.IPAddresses, ip)
		} else {
			template.DNSNames = append(template.DNSNames, h)
		}
	}

	certBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create certificate: %w", err)
	}
	return certBytes, privateKey, nil
}

// generatePEM generates a new certificate and key and returns it as PEM encoded bytes
func generatePEM() ([]byte, []byte, error) {
	certBytes, privateKey, err := generate()
	if err != nil {
		return nil, nil, err
	}
	certpem := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certBytes})
	keypem := pem.EncodeToMemory(pemBlockForKey(privateKey))
	return certpem, keypem, nil
}

// GenerateX509KeyPair generates a X509 key pair
func GenerateX509KeyPair() (*tls.Certificate, error) {
	certpem, keypem, err := generatePEM()

View on GitHub (pinned to 35bff19146)

Solutions

1. Check for crypto policy restrictions (GODEBUG=fips140=on / tls-max settings) that reject ECDSA P-256 and relax or configure an allowed algorithm
2. Retry after restarting the process — transient RNG/key failures resolve on regeneration
3. Verify the Go version / OS crypto libraries are not broken (rebuild or upgrade)
4. Bypass self-signed generation entirely by providing your own cert via a Kubernetes TLS secret (GetServerTLSConfigFromSecret path)

// preflight: confirm a key can be generated and self-signed under current crypto policy
key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil { return err }

cfg, err := tls.GenerateX509KeyPairTLSConfig(minVer)
if err != nil {
    if strings.Contains(err.Error(), "failed to create certificate") {
        // fall back to user-provided secret-based certs
        return tls.GetServerTLSConfigFromSecret(ctx, kube, secretName, minVer, ns)
    }
    return err
}

When it happens

Trigger: generate() reaches x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey) and it errors — typically due to a crypto/x509 internal failure, an unsupported/invalid ECDSA key, or a Go crypto policy restricting the algorithm (e.g. FIPS mode disallowing P-256 ECDSA signing).

Common situations: FIPS-restricted or hardened Go builds (GODEBUG crypto settings) rejecting ECDSA, corrupted crypto/rand output, or platform crypto policy changes after a Go/OS upgrade.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to generate serial number: %w
• failed to parse certificate: %w
• --client-certificate and --client-key must be provided toget
• request failed with: %w
• failure to create dynamic client: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/34fad3fa670693ae. Report an issue: GitHub.