coollabsio/coolify · error · RuntimeException

Failed to export private key: {openssl_error_string()}

Error message

Failed to export private key: {openssl_error_string()}

What it means

openssl_pkey_export() failed to serialize the freshly generated EC key to PEM. Key export in PHP requires a loadable OpenSSL configuration file; a missing or unreadable openssl.cnf (unset OPENSSL_CONF, wrong default path, container image without the file) is the classic cause even though key creation itself succeeded.

Source

Thrown at app/Helpers/SslHelper.php:46

        ?string $mountPath = null,
        bool $isPemKeyFileRequired = false,
    ): SslCertificate {
        $organizationName = self::DEFAULT_ORGANIZATION_NAME;
        $countryName = self::DEFAULT_COUNTRY_NAME;
        $stateName = self::DEFAULT_STATE_NAME;

        try {
            $privateKey = openssl_pkey_new([
                'private_key_type' => OPENSSL_KEYTYPE_EC,
                'curve_name' => 'secp521r1',
            ]);

            if ($privateKey === false) {
                throw new \RuntimeException('Failed to generate private key: '.openssl_error_string());
            }

            if (! openssl_pkey_export($privateKey, $privateKeyStr)) {
                throw new \RuntimeException('Failed to export private key: '.openssl_error_string());
            }

            if (! is_null($serverId) && ! $isCaCertificate) {
                $server = Server::find($serverId);
                if ($server) {
                    $ip = $server->getIp;
                    if ($ip) {
                        $type = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_IPV6)
                            ? 'IP'
                            : 'DNS';
                        $subjectAlternativeNames = array_unique(
                            array_merge($subjectAlternativeNames, ["$type:$ip"])
                        );
                    }
                }
            }

            $basicConstraints = $isCaCertificate ? 'critical, CA:TRUE, pathlen:0' : 'critical, CA:FALSE';

View on GitHub (pinned to 70b9acc424)

Solutions

1. Check php -i | grep openssl.cnf and make sure the shown file exists and is readable.
2. Set OPENSSL_CONF to a valid config (e.g. /etc/ssl/openssl.cnf) or install the openssl package in your image.
3. Persist a minimal openssl.cnf into the container and point the env var at it.

Example fix

# before: export fails inside the container with 'Failed to export private key'
FROM php:8.3-cli

# after: ship a usable OpenSSL config
FROM php:8.3-cli
RUN apt-get update && apt-get install -y openssl && rm -rf /var/lib/apt/lists/*
ENV OPENSSL_CONF=/etc/ssl/openssl.cnf

// Probe export capability (it depends on the OpenSSL config file)
$key = openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_EC, 'curve_name' => 'secp521r1']);
if ($key === false || ! openssl_pkey_export($key, $pem)) {
    throw new RuntimeException('OpenSSL cannot export keys (openssl.cnf missing?): '.openssl_error_string());
}

try {
    $cert = SslHelper::generateSslCertificate($commonName);
} catch (\RuntimeException $e) {
    if (str_starts_with($e->getMessage(), 'Failed to export private key')) {
        // config-file problem in the runtime: fix env, not code
        report('openssl.cnf problem: '.$e->getMessage());
        return null;
    }
    throw $e;
}

When it happens

Trigger: Running SslHelper::generateSslCertificate() in environments where openssl_pkey_new succeeds but the OpenSSL config needed by export routines is absent — most commonly minimal Docker/Alpine PHP images or hosts with a broken OPENSSL_CONF.

Common situations: Custom Docker images that delete /etc/ssl/openssl.cnf to save space; OPENSSL_CONF pointing at a mounted file that disappeared; Windows PHP builds with a wrong openssl.cnf path in php.ini.

Related errors

• Failed to generate private key: {openssl_error_string()}
• Failed to generate CSR: {openssl_error_string()}
• Failed to sign certificate: {openssl_error_string()}
• Failed to export certificate: {openssl_error_string()}
• SSL Certificate generation failed: {$e->getMessage()}

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/0f9bf14f9775cb37. Report an issue: GitHub.