caddyserver/caddy · error

rotating keys: %v

Error message

rotating keys: %v

What it means

Error "rotating keys: %v" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/distributedstek/distributedstek.go:174

	//nolint:errcheck
	defer s.storage.Unlock(s.ctx, stekLockName)

	// load the current STEKs from storage
	dstek, err := s.loadSTEK()
	if errors.Is(err, fs.ErrNotExist) {
		// if there is none, then make some right away
		dstek, err = s.rotateKeys(dstek)
		if err != nil {
			return dstek, fmt.Errorf("creating new STEK: %v", err)
		}
	} else if err != nil {
		// some other error, that's a problem
		return dstek, fmt.Errorf("loading STEK: %v", err)
	} else if time.Now().After(dstek.NextRotation) {
		// if current STEKs are outdated, rotate them
		dstek, err = s.rotateKeys(dstek)
		if err != nil {
			return dstek, fmt.Errorf("rotating keys: %v", err)
		}
	}

	return dstek, nil
}

// rotateKeys rotates the keys of oldSTEK and returns the new distributedSTEK
// with updated keys and timestamps. It stores the returned STEK in storage,
// so this function must only be called in a storage-provided lock.
func (s *Provider) rotateKeys(oldSTEK distributedSTEK) (distributedSTEK, error) {
	var newSTEK distributedSTEK
	var err error

	newSTEK.Keys, err = s.stekConfig.RotateSTEKs(oldSTEK.Keys)
	if err != nil {
		return newSTEK, err
	}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error and storage backend health; key rotation failed during a STEK operation.

When it happens

Trigger: Thrown at modules/caddytls/distributedstek/distributedstek.go:174 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/9cade39e62c00c98. Report an issue: GitHub.