caddyserver/caddy · critical

generating CA root: %v

Error message

generating CA root: %v

What it means

Inside CA.genRoot, after successfully creating the root keypair and self-signed cert, generateRoot is the first fallible step and this wrap reports its failure. (In practice most generation failures surface through error 584's identical path; 588's message appears when generateRoot itself returns an error during root creation in genRoot's direct call site.) It means Caddy could not construct a fresh root at all.

Source

Thrown at modules/caddypki/ca.go:323

		rootKeyPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyRootKey())
		if err != nil {
			return nil, nil, fmt.Errorf("loading root key: %v", err)
		}
		rootKey, err = certmagic.PEMDecodePrivateKey(rootKeyPEM)
		if err != nil {
			return nil, nil, fmt.Errorf("decoding root key: %v", err)
		}
	}

	return rootCert, rootKey, nil
}

func (ca CA) genRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {
	repl := ca.newReplacer()

	rootCert, rootKey, err = generateRoot(repl.ReplaceAll(ca.RootCommonName, ""))
	if err != nil {
		return nil, nil, fmt.Errorf("generating CA root: %v", err)
	}
	rootCertPEM, err := pemEncodeCert(rootCert.Raw)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root certificate: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootCert(), rootCertPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root certificate: %v", err)
	}
	rootKeyPEM, err := certmagic.PEMEncodePrivateKey(rootKey)
	if err != nil {
		return nil, nil, fmt.Errorf("encoding root key: %v", err)
	}
	err = ca.storage.Store(ca.ctx, ca.storageKeyRootKey(), rootKeyPEM)
	if err != nil {
		return nil, nil, fmt.Errorf("saving root key: %v", err)
	}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure host entropy/getrandom is healthy and retry provisioning.
2. Use a plain ASCII root_common_name without exotic characters.
3. Upgrade Caddy to the latest release.
4. Read the wrapped inner error in logs to identify whether keygen or signing failed.

// Verify RNG health before first provisioning
if _, err := cryptoRandRead32(); err != nil { fail("fix entropy before provisioning") }

if strings.Contains(err.Error(), "generating CA root") {
    // usually transient entropy/crypto issue: verify host, retry once, then report wrapped cause
}

When it happens

Trigger: First-time root generation where generateRoot errors: RNG/entropy failure, ECDSA key generation failure, or template expansion of RootCommonName producing data the certificate builder rejects. Runs only when no root currently exists in storage.

Common situations: Entropy-starved containers at first boot; minimal VMs where crypto/rand blocks or fails; malformed placeholders in root_common_name config; very old Go/Caddy versions with crypto bugs.

Related errors

• generating root: %v
• initializing certificate authority: %v
• loading root cert: %v
• parsing root certificate PEM: %v
• decoding root key: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/aad5559e816e6bf6. Report an issue: GitHub.