caddyserver/caddy · critical

initializing certificate authority

Error message

initializing certificate authority: %v

What it means

Caddy initializes an embedded step-ca authority (authority.NewEmbedded) with the accumulated options (signer, root cert, optional database). Any failure inside the smallstep library — malformed root, unusable signer, bad database config — surfaces wrapped as 'initializing certificate authority'. This is the last constructor step of CA.newAuthority, so failure here prevents any certificate issuance.

Solutions

1. Confirm the root cert and root key in the CA actually match: openssl x509 -pubkey on the cert vs openssl pkey -pubout on the key; re-import a matching pair.
2. Check wrapped error details from the smallstep library in the log line above; fix the specific cause (DB DSN, permissions, PEM contents).
3. If storage contents are corrupt, remove that CA's assets in storage so Caddy regenerates root+intermediate, then redistribute trust (caddy trust).
4. After upgrades, run caddy upgrade/build from source so the bundled step-ca version matches.

// Pre-validate the pairing of imported root assets before config load
pub1, _ := x509CertPub(rootCertFile)
pub2, _ := privKeyPub(rootKeyFile)
if !pub1.Equal(pub2) { log.Fatal("root cert/key mismatch") }

if err != nil {
    if strings.Contains(err.Error(), "initializing certificate authority") {
        // unwrap: root/signer/DB cause; check cert-key pairing and DB DSN next
    }
    return err
}

When it happens

Trigger: authority.NewEmbedded returns an error: e.g. root certificate malformed or unparseable as a step-ca root, the signer key/cert mismatch (root key does not match root cert), or a configured DB (authorityConfig.DB) that cannot be opened. Happens during CA setup at app start or on demand when building an issuer for internal issuers.

Common situations: Imported root cert and key that do not pair (rotated one but not the other); corrupt root PEM in storage; a step-ca database DSN that points to an unreachable database; version skew between Caddy and the smallstep step-ca library after an upgrade.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• generating CA root
• generating root
• loading root cert
• parsing root certificate PEM
• saving root certificate

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/09c8b1eba84e3220. Report an issue: GitHub.

Appendix: source

Thrown at modules/caddypki/ca.go:271

			return issuerChain, issuerKey, nil
		})
	}

	opts := []authority.Option{
		authority.WithConfig(&authority.Config{
			AuthorityConfig: authorityConfig.AuthConfig,
		}),
		signerOption,
		authority.WithX509RootCerts(rootCert),
	}

	// Add a database if we have one
	if authorityConfig.DB != nil {
		opts = append(opts, authority.WithDatabase(*authorityConfig.DB))
	}
	auth, err := authority.NewEmbedded(opts...)
	if err != nil {
		return nil, fmt.Errorf("initializing certificate authority: %v", err)
	}

	return auth, nil
}

func (ca CA) loadOrGenRoot() (rootCert *x509.Certificate, rootKey crypto.Signer, err error) {
	if ca.Root != nil {
		rootChain, rootSigner, err := ca.Root.Load()
		if err != nil {
			return nil, nil, err
		}
		return rootChain[0], rootSigner, nil
	}
	rootCertPEM, err := ca.storage.Load(ca.ctx, ca.storageKeyRootCert())
	if err != nil {
		if !errors.Is(err, fs.ErrNotExist) {
			return nil, nil, fmt.Errorf("loading root cert: %v", err)
		}

View on GitHub (pinned to 50e54ee279)