caddyserver/caddy · error

encoding root certificate: %v

Error message

encoding root certificate: %v

What it means

After generating a root certificate, Caddy PEM-encodes it (pemEncodeCert on rootCert.Raw) before storing. If encoding the DER bytes into a PEM block fails, genRoot aborts with 'encoding root certificate'. Encoding failures are essentially internal invariant breaks (bad DER from a malformed certificate) rather than environmental problems.

Source

Thrown at modules/caddypki/ca.go:327

		rootKey, err = certmagic.PEMDecodePrivateKey(rootKeyPEM)
		if err != nil {
			return nil, nil, fmt.Errorf("decoding root key: %v", err)
		}
	}

	return rootCert, rootKey, nil
}

func (ca CA) genRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {
	repl := ca.newReplacer()

	rootCert, rootKey, err = generateRoot(repl.ReplaceAll(ca.RootCommonName, ""))
	if err != nil {
		return nil, nil, fmt.Errorf("generating CA root: %v", err)
	}
	rootCertPEM, err := pemEncodeCert(rootCert.Raw)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root certificate: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootCert(), rootCertPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root certificate: %v", err)
	}
	rootKeyPEM, err := certmagic.PEMEncodePrivateKey(rootKey)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root key: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootKey(), rootKeyPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root key: %v", err)
	}

	return rootCert, rootKey, nil
}

func (ca CA) loadOrGenIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCertChain []*x509.Certificate, interKey crypto.Signer, err error) {

View on GitHub (pinned to 50e54ee279)

Solutions

1. Upgrade to the latest Caddy build (picks up current Go crypto/x509 and bundled libraries).
2. Retry provisioning once to rule out transient memory corruption.
3. If reproducible, collect the wrapped error and CA config and report upstream; as a workaround, import a root via the root{ cert/key } block instead of generating one.

// internal invariant failure: no caller-side remedy; capture and report
if strings.Contains(err.Error(), "encoding root certificate") {
    logErrorWithConfig(err, caConfig) // report upstream; workaround: import external root
}

When it happens

Trigger: pemEncodeCert(interCert/rootCert Raw) returns an error: the generated x509 certificate contains fields that serialize to invalid DER, or the Raw bytes are empty/nil due to an upstream library fault. Only reachable on the root-generation path (no existing root in storage).

Common situations: Rare. Seen with abnormal certificate contents (e.g. a common name or serial producing non-conforming DER) or after a botched Caddy/smallstep upgrade that yields certificates that fail to marshal. Retry after upgrade; if reproducible, report with logs.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• encoding root key: %v
• encoding intermediate certificate: %v
• parsing root certificate PEM: %v
• decoding root key: %v
• decoding intermediate certificate PEM: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/122800ad0b63ed40. Report an issue: GitHub.