caddyserver/caddy · error

generating new certificate: %v

Error message

generating new certificate: %v

What it means

Emitted by renewCertsForCA (modules/caddypki/maintain.go:91) when the intermediate certificate is expiring and genIntermediate fails after the root key was loaded successfully. Causes include a root key that does not match the root certificate (verifyKeysMatch failure inside loading), certificate-generation errors (unsupported signature algorithm, invalid lifetime), or entropy/OS failures while signing.

Source

Thrown at modules/caddypki/maintain.go:91

				zap.Duration("time_remaining", time.Until(ca.interChain[0].NotAfter)),
			)
		}
	}

	// only maintain the intermediate if it's not manually provided in the config
	if ca.Intermediate == nil {
		if ca.needsRenewal(ca.interChain[0]) {
			log.Info("intermediate expires soon; renewing",
				zap.Duration("time_remaining", time.Until(ca.interChain[0].NotAfter)),
			)

			rootCert, rootKey, err := ca.loadOrGenRoot()
			if err != nil {
				return fmt.Errorf("loading root key: %v", err)
			}
			interCert, interKey, err := ca.genIntermediate(rootCert, rootKey)
			if err != nil {
				return fmt.Errorf("generating new certificate: %v", err)
			}
			ca.interChain, ca.interKey = []*x509.Certificate{interCert}, interKey

			log.Info("renewed intermediate",
				zap.Time("new_expiration", ca.interChain[0].NotAfter),
			)
		}
	}

	return nil
}

// needsRenewal reports whether the certificate is within its renewal window
// (i.e. the fraction of lifetime remaining is less than or equal to RenewalWindowRatio).
func (ca *CA) needsRenewal(cert *x509.Certificate) bool {
	ratio := ca.RenewalWindowRatio
	if ratio <= 0 {
		ratio = defaultRenewalWindowRatio

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error: if it mentions key type/mismatch, align root cert and root key files (same CA, same key) or delete both from <storage>/pki/authorities/<id>/ to force regeneration
2. Regenerate the whole CA pair together and re-trust the new root: rm -rf <storage>/pki/authorities/local then restart Caddy, then re-install the root cert (caddy trust / manually add to the trust store)
3. Upgrade to the current Caddy release to pick up fixes in certificate generation
4. If it recurs on every maintenance tick, capture the wrapped error in logs and validate the pair manually with openssl x509 and openssl pkey

Example fix

# before: mismatched root pair forces intermediate regeneration to fail every 12h
sudo ls /var/lib/caddy/pki/authorities/local/   # root.crt new, root.key old

# after: force a clean, self-consistent CA
sudo systemctl stop caddy
sudo rm -rf /var/lib/caddy/pki/authorities/local
sudo systemctl start caddy
caddy trust   # re-install the freshly generated root

// ensure the root pair on disk is self-consistent so genIntermediate cannot fail on mismatch
func rootPairConsistent(rootCertPEM, rootKeyPEM []byte) error {
	cb, _ := pem.Decode(rootCertPEM)
	crt, err := x509.ParseCertificate(cb.Bytes)
	if err != nil {
		return err
	}
	kb, _ := pem.Decode(rootKeyPEM)
	key, err := x509.ParsePKCS8PrivateKey(kb.Bytes)
	if err != nil {
		return err
	}
	if !crt.PublicKey.(interface{ Equal(crypto.PublicKey) bool }).Equal(key.(crypto.Signer).Public()) {
		return errors.New("root cert and root key do not match")
	}
	return nil
}

if _, _, err := ca.genIntermediate(rootCert, rootKey); err != nil {
    log.Error("intermediate regeneration failed", zap.Error(err))
    // maintenance loop retries each interval; if the cause is a mismatched
    // root pair, fix or delete the authority's storage subtree to regenerate
}

When it happens

Trigger: ca.needsRenewal(ca.interChain[0]) is true, ca.Intermediate is not manually configured, loadOrGenRoot succeeds, then ca.genIntermediate(rootCert, rootKey) returns an error - typically because the on-disk root key pairs with a different root certificate, or signing constraints (e.g. RSA key too small for the requested signature algorithm) are violated.

Common situations: Root certificate was replaced without replacing the root key; mixed files after a botched CA migration; old Caddy versions' storage reused with new key formats; a root key generated with an algorithm the current build's dependency chain rejects.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• loading root key: %v
• loading intermediate cert: %v
• generating new intermediate cert: %v
• decoding intermediate certificate PEM: %v
• generating CA intermediate: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/211a5347dcc1320c. Report an issue: GitHub.