caddyserver/caddy · error

creating new STEK: %v

Error message

creating new STEK: %v

What it means

Error "creating new STEK: %v" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/distributedstek/distributedstek.go:165

// currently exists, a new STEK is created and persisted. If the
// current STEK is outdated (NextRotation time is in the past),
// then it is rotated and persisted. The resulting STEK is returned.
func (s *Provider) getSTEK() (distributedSTEK, error) {
	err := s.storage.Lock(s.ctx, stekLockName)
	if err != nil {
		return distributedSTEK{}, fmt.Errorf("failed to acquire storage lock: %v", err)
	}

	//nolint:errcheck
	defer s.storage.Unlock(s.ctx, stekLockName)

	// load the current STEKs from storage
	dstek, err := s.loadSTEK()
	if errors.Is(err, fs.ErrNotExist) {
		// if there is none, then make some right away
		dstek, err = s.rotateKeys(dstek)
		if err != nil {
			return dstek, fmt.Errorf("creating new STEK: %v", err)
		}
	} else if err != nil {
		// some other error, that's a problem
		return dstek, fmt.Errorf("loading STEK: %v", err)
	} else if time.Now().After(dstek.NextRotation) {
		// if current STEKs are outdated, rotate them
		dstek, err = s.rotateKeys(dstek)
		if err != nil {
			return dstek, fmt.Errorf("rotating keys: %v", err)
		}
	}

	return dstek, nil
}

// rotateKeys rotates the keys of oldSTEK and returns the new distributedSTEK
// with updated keys and timestamps. It stores the returned STEK in storage,
// so this function must only be called in a storage-provided lock.

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error; this usually indicates a crypto/RNG failure on the host.

When it happens

Trigger: Thrown at modules/caddytls/distributedstek/distributedstek.go:165 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/39471f4dc5bfb0d3. Report an issue: GitHub.