What causes "Failed to sign certificate: {openssl_error_string()}" in coollabsio/coolify?

If signing with a CA: regenerate the CA certificate and key together so the pair matches, then reissue the leaf certificate.

coollabsio/coolify · error · RuntimeException

Failed to sign certificate: {openssl_error_string()}

Error message

Failed to sign certificate: {openssl_error_string()}

What it means

openssl_csr_sign() returned false: the CSR could not be signed with sha512 and the v3_req extension section. When $caCert/$caKey are provided (leaf certificates signed by a generated CA), a mismatched or malformed CA certificate/key pair is the most common cause; otherwise the failure is in the OpenSSL config or digest/extension handling.

Source

Thrown at app/Helpers/SslHelper.php:148

            if ($csr === false) {
                throw new \RuntimeException('Failed to generate CSR: '.openssl_error_string());
            }

            $certificate = openssl_csr_sign(
                $csr,
                $caCert ?? null,
                $caKey ?? $privateKey,
                $validityDays,
                [
                    'digest_alg' => 'sha512',
                    'config' => $tempConfigPath,
                    'x509_extensions' => 'v3_req',
                ],
                random_int(1, PHP_INT_MAX)
            );

            if ($certificate === false) {
                throw new \RuntimeException('Failed to sign certificate: '.openssl_error_string());
            }

            if (! openssl_x509_export($certificate, $certificateStr)) {
                throw new \RuntimeException('Failed to export certificate: '.openssl_error_string());
            }

            SslCertificate::query()
                ->where('resource_type', $resourceType)
                ->where('resource_id', $resourceId)
                ->where('server_id', $serverId)
                ->delete();

            $sslCertificate = SslCertificate::create([
                'ssl_certificate' => $certificateStr,
                'ssl_private_key' => $privateKeyStr,
                'resource_type' => $resourceType,
                'resource_id' => $resourceId,
                'server_id' => $serverId,

View on GitHub (pinned to 70b9acc424)

Solutions

If signing with a CA: regenerate the CA certificate and key together so the pair matches, then reissue the leaf certificate.
Verify the CA inputs parse: openssl x509 -in ca.pem -noout and openssl pkey -in ca.key -check.
Read openssl_error_string() — key mismatch errors name the CA key explicitly.
On restricted hosts, confirm sha512 is permitted by security policy.

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate CA inputs parse as a matching pair before requesting a signed cert
$caCertRes = openssl_x509_read($caCert);
$caKeyRes = openssl_pkey_get_private($caKey);
if ($caCertRes === false || $caKeyRes === false) {
    throw new RuntimeException('CA certificate or key unreadable: '.openssl_error_string());
}
if (! openssl_x509_check_private_key($caCertRes, $caKeyRes)) {
    throw new RuntimeException('CA certificate does not match CA private key.');
}

Try / catch

try {
    $cert = SslHelper::generateSslCertificate($commonName, caCert: $caCert, caKey: $caKey);
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), 'Failed to sign certificate')) {
        // most often a CA cert/key mismatch — regenerate the pair together
        report('Certificate signing failed: '.$e->getMessage());
        return null;
    }
    throw $e;
}

Prevention

Always create and store CA certificate + key as one unit; never rotate one side alone.
Run openssl x509 -checkend / openssl pkey -check health checks on stored CA material.
Verify CA inputs with openssl_x509_check_private_key() before any signing flow.

When it happens

Trigger: Generating a leaf certificate where the stored CA certificate does not match the CA private key; corrupted CA key PEM; an OpenSSL build that rejects sha512 or the v3_req extensions written to the temp config.

Common situations: CA key pair rotated on one side only (cert updated, key stale or vice versa); CA certificate data truncated in the database; FIPS-mode OpenSSL disallowing sha512 with certain key types.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of coollabsio/coolify@70b9acc424 (2026-08-17). Data as JSON: /api/errors/f6f46bb4b929a644. Report an issue: GitHub.