caddyserver/caddy · critical

initializing certificate authority: %v

Error message

initializing certificate authority: %v

What it means

Caddy initializes an embedded step-ca authority (authority.NewEmbedded) with the accumulated options (signer, root cert, optional database). Any failure inside the smallstep library — malformed root, unusable signer, bad database config — surfaces wrapped as 'initializing certificate authority'. This is the last constructor step of CA.newAuthority, so failure here prevents any certificate issuance.

Source

Thrown at modules/caddypki/ca.go:271

			return issuerChain, issuerKey, nil
		})
	}

	opts := []authority.Option{
		authority.WithConfig(&authority.Config{
			AuthorityConfig: authorityConfig.AuthConfig,
		}),
		signerOption,
		authority.WithX509RootCerts(rootCert),
	}

	// Add a database if we have one
	if authorityConfig.DB != nil {
		opts = append(opts, authority.WithDatabase(*authorityConfig.DB))
	}
	auth, err := authority.NewEmbedded(opts...)
	if err != nil {
		return nil, fmt.Errorf("initializing certificate authority: %v", err)
	}

	return auth, nil
}

func (ca CA) loadOrGenRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {
	if ca.Root != nil {
		rootChain, rootSigner, err := ca.Root.Load()
		if err != nil {
			return nil, nil, err
		}
		return rootChain[0], rootSigner, nil
	}
	rootCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyRootCert())
	if err != nil {
		if !errors.Is(err, fs.ErrNotExist) {
			return nil, nil, fmt.Errorf("loading root cert: %v", err)
		}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Confirm the root cert and root key in the CA actually match: openssl x509 -pubkey on the cert vs openssl pkey -pubout on the key; re-import a matching pair.
2. Check wrapped error details from the smallstep library in the log line above; fix the specific cause (DB DSN, permissions, PEM contents).
3. If storage contents are corrupt, remove that CA's assets in storage so Caddy regenerates root+intermediate, then redistribute trust (caddy trust).
4. After upgrades, run caddy upgrade/build from source so the bundled step-ca version matches.

// Pre-validate the pairing of imported root assets before config load
pub1, _ := x509CertPub(rootCertFile)
pub2, _ := privKeyPub(rootKeyFile)
if !pub1.Equal(pub2) { log.Fatal("root cert/key mismatch") }

if err != nil {
    if strings.Contains(err.Error(), "initializing certificate authority") {
        // unwrap: root/signer/DB cause; check cert-key pairing and DB DSN next
    }
    return err
}

When it happens

Trigger: authority.NewEmbedded returns an error: e.g. root certificate malformed or unparseable as a step-ca root, the signer key/cert mismatch (root key does not match root cert), or a configured DB (authorityConfig.DB) that cannot be opened. Happens during CA setup at app start or on demand when building an issuer for internal issuers.

Common situations: Imported root cert and key that do not pair (rotated one but not the other); corrupt root PEM in storage; a step-ca database DSN that points to an unreachable database; version skew between Caddy and the smallstep step-ca library after an upgrade.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• loading root cert: %v
• generating root: %v
• parsing root certificate PEM: %v
• generating CA root: %v
• saving root certificate: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/09c8b1eba84e3220. Report an issue: GitHub.