caddyserver/caddy · critical

generating CA intermediate: %v

Error message

generating CA intermediate: %v

What it means

In CA.genIntermediate, generateIntermediate (signing a new intermediate with the root for IntermediateLifetime) failed and the error is wrapped as 'generating CA intermediate'. This is the same signing step as error 594 but reported from genIntermediate's own call site — it means Caddy could not produce a fresh intermediate at all, blocking leaf issuance.

Source

Thrown at modules/caddypki/ca.go:388

		interKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyIntermediateKey())
		if err != nil {
			return nil, nil, fmt.Errorf("loading intermediate key: %v", err)
		}
		interKey, err = certmagic.PEMDecodePrivateKey(interKeyPEM)
		if err != nil {
			return nil, nil, fmt.Errorf("decoding intermediate key: %v", err)
		}
	}

	return interCertChain, interKey, nil
}

func (ca CA) genIntermediate(rootCert *x509.Certificate, rootKey crypto.Signer) (interCert *x509.Certificate, interKey crypto.Signer, err error) {
	repl := ca.newReplacer()

	interCert, interKey, err = generateIntermediate(repl.ReplaceAll(ca.IntermediateCommonName, ""), rootCert, rootKey, time.Duration(ca.IntermediateLifetime))
	if err != nil {
		return nil, nil, fmt.Errorf("generating CA intermediate: %v", err)
	}
	interCertPEM, err := pemEncodeCert(interCert.Raw)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding intermediate certificate: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateCert(), interCertPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving intermediate certificate: %v", err)
	}
	interKeyPEM, err := certmagic.PEMEncodePrivateKey(interKey)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding intermediate key: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyIntermediateKey(), interKeyPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving intermediate key: %v", err)
	}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Verify the root cert/key pair matches (compare openssl x509 -pubkey and openssl pkey -pubout).
2. Ensure host entropy is healthy; retry provisioning.
3. Use plain ASCII intermediate_common_name.
4. Upgrade Caddy to current; capture the wrapped inner error for diagnosis if it persists.

// Pair-check the root before issuance-dependent deployments
if !pubKeysMatch(rootCert, rootKey) { fail("root pair mismatch") }

if strings.Contains(err.Error(), "generating CA intermediate") {
    // diagnose root pairing/entropy via wrapped error; retry once after fix
}

When it happens

Trigger: Intermediate generation path (nothing valid in storage) where generateIntermediate returns an error: root key cannot sign (pair mismatch, unsupported algorithm), RNG/entropy failure, or template/subject error from IntermediateCommonName expansion.

Common situations: Imported root whose key does not match the cert; entropy-starved containers at provisioning time; unusual common-name templates; library version regressions.

Related errors

• generating new intermediate cert: %v
• loading signing key: %v
• generating CA root: %v
• loading intermediate cert: %v
• decoding intermediate certificate PEM: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/960bbd0507b95603. Report an issue: GitHub.