What causes "Failed to generate CSR: {openssl_error_string()}" in coollabsio/coolify?

Check the appended openssl_error_string() — config-parse errors point at the generated temp config, key errors at the key step.

coollabsio/coolify · error · RuntimeException

Failed to generate CSR: {openssl_error_string()}

Error message

Failed to generate CSR: {openssl_error_string()}

What it means

openssl_csr_new() returned false while building the certificate signing request with the subject (CN/O/C/ST) and SAN/extension sections written to a temporary OpenSSL config file. Failure means the temp config could not be written/read, its extension syntax is invalid, or the key resource is unusable. openssl_error_string() in the message names the failing routine.

Source

Thrown at app/Helpers/SslHelper.php:131

            CONF;

            $tempConfig = tmpfile();
            fwrite($tempConfig, $config);
            $tempConfigPath = stream_get_meta_data($tempConfig)['uri'];

            $csr = openssl_csr_new([
                'commonName' => $commonName,
                'organizationName' => $organizationName,
                'countryName' => $countryName,
                'stateOrProvinceName' => $stateName,
            ], $privateKey, [
                'digest_alg' => 'sha512',
                'config' => $tempConfigPath,
                'req_extensions' => 'req_ext',
            ]);

            if ($csr === false) {
                throw new \RuntimeException('Failed to generate CSR: '.openssl_error_string());
            }

            $certificate = openssl_csr_sign(
                $csr,
                $caCert ?? null,
                $caKey ?? $privateKey,
                $validityDays,
                [
                    'digest_alg' => 'sha512',
                    'config' => $tempConfigPath,
                    'x509_extensions' => 'v3_req',
                ],
                random_int(1, PHP_INT_MAX)
            );

            if ($certificate === false) {
                throw new \RuntimeException('Failed to sign certificate: '.openssl_error_string());
            }

View on GitHub (pinned to 70b9acc424)

Solutions

Check the appended openssl_error_string() — config-parse errors point at the generated temp config, key errors at the key step.
Ensure /tmp is writable and has space in the environment running Coolify/this code.
Upgrade the OpenSSL/PHP build if the error mentions unsupported extension syntax.

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure temp config prerequisites before generation
$tempConfigPath = tempnam(sys_get_temp_dir(), 'openssl');
if ($tempConfigPath === false || ! is_writable($tempConfigPath)) {
    throw new RuntimeException('Cannot write OpenSSL temp config in '.sys_get_temp_dir());
}

Try / catch

try {
    $cert = SslHelper::generateSslCertificate($commonName);
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), 'Failed to generate CSR')) {
        report('CSR generation failed: '.$e->getMessage()); // includes openssl_error_string()
        return null;
    }
    throw $e;
}

Prevention

Keep /tmp writable and monitored for space in the runtime environment.
Pin known-good OpenSSL versions in base images; re-test after upgrades.
Log openssl_error_string() whenever surfacing these failures — it names the failing config routine.

When it happens

Trigger: Certificate generation where the temp config file (tempConfigPath) failed to be created (full /tmp, wrong permissions), or the generated openssl.cnf extension blocks (req_ext/v3_req) are rejected by the OpenSSL build in use.

Common situations: Containers with a read-only or full /tmp; SELinux/AppArmor denying reads of the temp file; older OpenSSL versions rejecting certain SAN formatting; disk exhaustion during certificate issuance.

Related errors

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/c81574dfb596d0d5. Report an issue: GitHub.