caddyserver/caddy · error

making X509 key pair: %v

Error message

making X509 key pair: %v

What it means

Error "making X509 key pair: %v" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/folderloader.go:171

	}

	certPEMBytes, keyPEMBytes := certBuilder.Bytes(), keyBuilder.Bytes()
	if len(certPEMBytes) == 0 {
		return tls.Certificate{}, fmt.Errorf("failed to parse PEM data")
	}
	if len(keyPEMBytes) == 0 {
		return tls.Certificate{}, fmt.Errorf("no private key block found")
	}

	// if the start of the key file looks like an encrypted private key,
	// reject it with a helpful error message
	if strings.HasPrefix(string(keyPEMBytes[:40]), "ENCRYPTED") {
		return tls.Certificate{}, fmt.Errorf("encrypted private keys are not supported; please decrypt the key first")
	}

	cert, err := tls.X509KeyPair(certPEMBytes, keyPEMBytes)
	if err != nil {
		return tls.Certificate{}, fmt.Errorf("making X509 key pair: %v", err)
	}

	return cert, nil
}

var (
	_ CertificateLoader = (FolderLoader)(nil)
	_ caddy.Provisioner = (FolderLoader)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Ensure the certificate and private key match and are valid; the wrapped error explains the key pair failure.

When it happens

Trigger: Thrown at modules/caddytls/folderloader.go:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/296d670c77006fd1. Report an issue: GitHub.