argoproj/argo-workflows · critical

failed to generate serial number: %w

Error message

failed to generate serial number: %w

What it means

Argo Workflows' internal self-signed cert generator (util/tls) failed to draw a random serial number for the new X.509 certificate using crypto/rand. rand.Int only fails when the system CSPRNG is unavailable, so this error almost always indicates a broken entropy source in the environment running the argo server, not a code or config problem.

Source

Thrown at util/tls/tls.go:62

	}
}

func generate() ([]byte, crypto.PrivateKey, error) {
	hosts := []string{"localhost"}

	var err error
	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate private key: %w", err)
	}

	notBefore := time.Now()
	notAfter := notBefore.Add(365 * 24 * time.Hour)

	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return nil, nil, fmt.Errorf("failed to generate serial number: %w", err)
	}

	template := x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"ArgoProj"},
		},
		NotBefore: notBefore,
		NotAfter:  notAfter,

		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
		BasicConstraintsValid: true,
	}

	for _, h := range hosts {
		if ip := net.ParseIP(h); ip != nil {
			template.IPAddresses = append(template.IPAddresses, ip)

View on GitHub (pinned to 35bff19146)

Solutions

1. Fix the entropy source in the environment (ensure /dev/urandom is accessible and getrandom(2) is permitted by the container/seccomp profile)
2. Restart the process — the failure is typically transient if the RNG recovers
3. If it persists, check the OS kernel RNG state and host virtualization entropy settings
4. Update Argo Workflows if your platform has a known crypto/rand issue

// ensure the OS RNG is readable before generating certs
if f, err := os.Open("/dev/urandom"); err != nil { return fmt.Errorf("no entropy source: %w", err) } else { f.Close() }

err := tls.GenerateX509KeyPair()
if err != nil {
    if strings.Contains(err.Error(), "serial number") {
        // entropy issue: retry after checking /dev/urandom
        return retryAfterEntropyCheck(err)
    }
    return err
}

When it happens

Trigger: Calling GenerateX509KeyPair/GenerateX509KeyPairTLSConfig (which invoke generate via generatePEM) when rand.Int(rand.Reader, serialNumberLimit) returns an error — e.g. /dev/urandom unavailable or blocked, running in a sandbox/container with no entropy source, or a corrupted crypto/rand reader.

Common situations: Rare; seen on stripped-down containers lacking entropy, restricted seccomp profiles blocking getrandom(2), or exotic OS environments where the RNG fails at process start.

Related errors

• failed to create certificate: %w
• failed to generate key: %w
• --client-certificate and --client-key must be provided toget
• request failed with: %w
• failure to create dynamic client: %w

AI-assisted analysis of argoproj/argo-workflows@35bff19146 (2026-09-03). Data as JSON: /api/errors/bcb4b9484955f2ed. Report an issue: GitHub.