cloudflare/cloudflared · error

couldn't generate the secret for your new tunnel

Error message

couldn't generate the secret for your new tunnel

What it means

Raised in subcommandContext.create when no secret was supplied and generateTunnelSecret failed to produce random bytes for the new named tunnel. Tunnel creation cannot proceed without a secret, so `cloudflared tunnel create` and ad-hoc named tunnels fail at this step.

Source

Thrown at cmd/cloudflared/tunnel/subcommand_context.go:136

				"You may have accidentally used the filepath to cert.pem, which is generated by `cloudflared tunnel " +
				"login`.")
		}
		return connection.Credentials{}, invalidJSONCredentialError{path: filePath, err: err}
	}
	return credentials, nil
}

func (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*cfapi.Tunnel, error) {
	client, err := sc.client()
	if err != nil {
		return nil, errors.Wrap(err, "couldn't create client to talk to Cloudflare Tunnel backend")
	}

	var tunnelSecret []byte
	if secret == "" {
		tunnelSecret, err = generateTunnelSecret()
		if err != nil {
			return nil, errors.Wrap(err, "couldn't generate the secret for your new tunnel")
		}
	} else {
		decodedSecret, err := base64.StdEncoding.DecodeString(secret)
		if err != nil {
			return nil, errors.Wrap(err, "Couldn't decode tunnel secret from base64")
		}
		tunnelSecret = decodedSecret
		if len(tunnelSecret) < 32 {
			return nil, errors.New("Decoded tunnel secret must be at least 32 bytes long")
		}
	}

	tunnel, err := client.CreateTunnel(name, tunnelSecret)
	if err != nil {
		return nil, errors.Wrap(err, "Create Tunnel API call failed")
	}

	credential, err := sc.credential()

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check that the host CSPRNG is available (getrandom syscall or /dev/urandom readable)
2. In containers, ensure /dev/urandom is not masked and seccomp allows getrandom
3. Pass an explicit secret instead: `--secret <base64 32+ bytes>` to skip generation
4. Reboot/upgrade the host kernel or container runtime if entropy syscalls fail

Example fix

// before
cloudflared tunnel create mytunnel   # rand fails
// after
head -c 32 /dev/urandom | base64 > secret.b64
cloudflared tunnel create --secret "$(cat secret.b64)" mytunnel

// verify CSPRNG availability before generating secrets
if f, err := os.Open("/dev/urandom"); err != nil {
    return fmt.Errorf("no entropy source available: %w", err)
} else {
    _ = f.Close()
}

When it happens

Trigger: secret == "" and crypto/rand read fails inside generateTunnelSecret during `cloudflared tunnel create`.

Common situations: Host entropy problems (very old kernels/containers without getrandom); restricted /dev/urandom in locked-down sandboxes; Go runtime CSPRNG initialization failures.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• failed to generate lock ID: %w
• Invalid CIDR supplied for %s
• invalid connection override: %s
• failed to build quick tunnel request
• failed to request quick Tunnel

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/086bab0625fba083. Report an issue: GitHub.