juanfont/headscale · error

creating certificates for derp test: %w

Error message

creating certificates for derp test: %w

What it means

Returned by the DERP-in-container integration test helper (dsic) when integrationutil.CreateCertificate fails to generate the self-signed CA/server certificate for the DERPer's test hostname. It wraps the underlying crypto error from certificate generation.

Source

Thrown at integration/dsic/dsic.go:163

) (*DERPServerInContainer, error) {
	hash := rands.HexString(dsicHashLength)

	// Include run ID in hostname for easier identification of which test run owns this container
	runID := dockertestutil.GetIntegrationRunID()

	var hostname string

	if runID != "" {
		// Use last 6 chars of run ID (the random hash part) for brevity
		runIDShort := runID[len(runID)-6:]
		hostname = fmt.Sprintf("derp-%s-%s-%s", runIDShort, strings.ReplaceAll(version, ".", "-"), hash)
	} else {
		hostname = fmt.Sprintf("derp-%s-%s", strings.ReplaceAll(version, ".", "-"), hash)
	}

	tlsCACert, tlsCert, tlsKey, err := integrationutil.CreateCertificate(hostname)
	if err != nil {
		return nil, fmt.Errorf("creating certificates for derp test: %w", err)
	}

	dsic := &DERPServerInContainer{
		version:   version,
		hostname:  hostname,
		pool:      pool,
		networks:  networks,
		tlsCACert: tlsCACert,
		tlsCert:   tlsCert,
		tlsKey:    tlsKey,
		stunPort:  3478, //nolint
		derpPort:  443,  //nolint
	}

	// Install the CA cert so the DERP server trusts its own certificate
	// and any headscale CA certs passed via [WithCACert].
	dsic.caCerts = append(dsic.caCerts, tlsCACert)

View on GitHub (pinned to 565fd254d0)

Solutions

1. Re-run the integration test — transient entropy/crypto failures usually clear
2. Inspect the wrapped CreateCertificate error for the exact crypto failure (invalid CN, key generation)
3. Verify the version string and runID passed to the hostname template produce a sane DNS-like name

dsic, err := dsic.NewDERPServerInContainer(...)
if err != nil {
    if strings.Contains(err.Error(), "creating certificates") {
        // transient crypto/entropy issue: rerun the helper once
    }
    t.Fatalf("derp setup: %v", err)
}

When it happens

Trigger: Calling NewDERPServerInContainer during an integration test run; CreateCertificate can fail on entropy exhaustion or malformed hostnames built from the runID/version/hash template.

Common situations: Integration test environment issues: containers with depleted entropy during cert generation, or a broken hostname string (e.g. version containing unexpected characters) producing an invalid CN.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• writing TLS certificate to container: %w
• writing TLS key to container: %w
• %s starting tailscale DERPer container (version: %s): %w
• DERPer is not ready: %w
• writing TLS key to container: %w

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/81be3db6f36f6e55. Report an issue: GitHub.