What causes "Failed to export certificate: {openssl_error_string()}" in coollabsio/coolify?

Apply the same fixes as for key export: valid openssl.cnf, correct OPENSSL_CONF, writable temp paths.

coollabsio/coolify · error · RuntimeException

Failed to export certificate: {openssl_error_string()}

Error message

Failed to export certificate: {openssl_error_string()}

What it means

openssl_x509_export() returned false while converting the just-signed certificate resource to PEM. Almost always an artifact of a broken OpenSSL configuration or a corrupted certificate resource from a partially failed signing step; the appended openssl_error_string() identifies which.

Source

Thrown at app/Helpers/SslHelper.php:152

            $certificate = openssl_csr_sign(
                $csr,
                $caCert ?? null,
                $caKey ?? $privateKey,
                $validityDays,
                [
                    'digest_alg' => 'sha512',
                    'config' => $tempConfigPath,
                    'x509_extensions' => 'v3_req',
                ],
                random_int(1, PHP_INT_MAX)
            );

            if ($certificate === false) {
                throw new \RuntimeException('Failed to sign certificate: '.openssl_error_string());
            }

            if (! openssl_x509_export($certificate, $certificateStr)) {
                throw new \RuntimeException('Failed to export certificate: '.openssl_error_string());
            }

            SslCertificate::query()
                ->where('resource_type', $resourceType)
                ->where('resource_id', $resourceId)
                ->where('server_id', $serverId)
                ->delete();

            $sslCertificate = SslCertificate::create([
                'ssl_certificate' => $certificateStr,
                'ssl_private_key' => $privateKeyStr,
                'resource_type' => $resourceType,
                'resource_id' => $resourceId,
                'server_id' => $serverId,
                'configuration_dir' => $configurationDir,
                'mount_path' => $mountPath,
                'valid_until' => CarbonImmutable::now()->addDays($validityDays),
                'is_ca_certificate' => $isCaCertificate,

View on GitHub (pinned to 70b9acc424)

Solutions

Apply the same fixes as for key export: valid openssl.cnf, correct OPENSSL_CONF, writable temp paths.
Re-run generation after fixing the environment — a one-off corrupt resource is resolved by regeneration.
Check openssl_error_string() output to distinguish config errors from certificate errors.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    $cert = SslHelper::generateSslCertificate($commonName);
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), 'Failed to export certificate')) {
        report('Certificate export failed: '.$e->getMessage()); // carries openssl_error_string()
        return null;
    }
    throw $e;
}

Prevention

Same environment hygiene as the other OpenSSL steps: valid openssl.cnf, writable temp dir.
Treat any single step failing as an environment smell — fix it once rather than per-certificate.
Cache generated certificates (SslCertificate records) so transient regeneration failures don't affect running services.

When it happens

Trigger: Certificate generation on hosts with a missing/unreadable openssl.cnf (export routines depend on it) or where an upstream step degraded the resource; runs immediately after openssl_csr_sign succeeded.

Common situations: Same environments as the other SslHelper OpenSSL failures: minimal container images, bad OPENSSL_CONF, mounted config files removed at runtime.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/7756f202bd71481f. Report an issue: GitHub.