argoproj/argo-workflows · error

failed to generate private key: %w

Error message

failed to generate private key: %w

What it means

util/tls generate() failed to create the ECDSA P-256 private key for the self-signed certificate (ecdsa.GenerateKey with crypto/rand). Essentially only fires on entropy or crypto backend failures; argo-server/CLI TLS cert generation aborts.

Source

Thrown at util/tls/tls.go:53

	case *ecdsa.PrivateKey:
		b, err := x509.MarshalECPrivateKey(k)
		if err != nil {
			log.Print(err)
			os.Exit(2)
		}
		return &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}
	default:
		return nil
	}
}

func generate() ([]byte, crypto.PrivateKey, error) {
	hosts := []string{"localhost"}

	var err error
	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate private key: %w", err)
	}

	notBefore := time.Now()
	notAfter := notBefore.Add(365 * 24 * time.Hour)

	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"ArgoProj"},
		},
		NotBefore: notBefore,
		NotAfter:  notAfter,

View on GitHub (pinned to 35bff19146)

Solutions

1. Retry — entropy exhaustion is usually transient
2. Check for a broken crypto/entropy setup in the container or host

When it happens

Trigger: Thrown at util/tls/tls.go:53 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/0760290f162dd25d. Report an issue: GitHub.