What causes "failed to get TLS certificate for: %s:%d error: %s" in kgretzky/evilginx2?

Check the embedded error text (after 'error:') to see the root cause and fix that first

failed to get TLS certificate for: %s:%d error: %s

Error message

failed to get TLS certificate for: %s:%d error: %s

What it means

getSelfSignedCertificate wraps failures from getTLSCertificate in this error when the host is not the local/loopback case (so a managed certificate must be fetched for host:port). The underlying reason (TLS dial error, certificate not found/managed, etc.) is embedded in the %s at the end. Callers of the certificate lookup (anonymous closure, e.g. the TLS config callback) receive nil cert and this error.

Source

Thrown at core/certdb.go:308

			return nil, err
		}

		template = x509.Certificate{
			SerialNumber:          serialNumber,
			Issuer:                x509ca.Subject,
			Subject:               pkix.Name{Organization: []string{"Evilginx Signature Trust Co."}},
			NotBefore:             time.Now(),
			NotAfter:              time.Now().Add(time.Hour * 24 * 180),
			KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
			ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
			DNSNames:              []string{host},
			BasicConstraintsValid: true,
		}
		template.Subject.CommonName = host
	} else {
		srvCert, err := o.getTLSCertificate(host, port)
		if err != nil {
			return nil, fmt.Errorf("failed to get TLS certificate for: %s:%d error: %s", host, port, err)
		} else {
			serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
			serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
			if err != nil {
				return nil, err
			}

			template = x509.Certificate{
				SerialNumber:          serialNumber,
				Issuer:                x509ca.Subject,
				Subject:               srvCert.Subject,
				NotBefore:             srvCert.NotBefore,
				NotAfter:              time.Now().Add(time.Hour * 24 * 180),
				KeyUsage:              srvCert.KeyUsage,
				ExtKeyUsage:           srvCert.ExtKeyUsage,
				IPAddresses:           srvCert.IPAddresses,
				DNSNames:              []string{phish_host},
				BasicConstraintsValid: true,

View on GitHub (pinned to 4c0988a1d9)

Solutions

Check the embedded error text (after 'error:') to see the root cause and fix that first
Verify the host is configured and enabled in the relevant phishlet so its certificate is managed/cached
Confirm host:port is correct and reachable (dig/nslookup, curl -v https://host:port)
Pre-generate the certificate for the host or fall back to self-signed generation

Example fix

// before
getSelfSignedCertificate("api.phish.example.com", 443) // host not in any enabled phishlet
// after
phishlets hostname myphishlet api.phish.example.com
phishlets enable myphishlet
# now the cert for api.phish.example.com is managed and retrievable

Defensive patterns

Strategy: try-catch

Validate before calling

// before requesting, confirm the host is managed and reachable
addr := fmt.Sprintf("%s:%d", host, port)
if _, err := net.LookupHost(host); err != nil { log.Printf("host %s unresolvable", host) }
if c, err := tls.Dial("tcp", addr, &tls.Config{InsecureSkipVerify: true}); err == nil { c.Close() } else { log.Printf("TLS unreachable: %v", err) }

Try / catch

cert, err := db.getSelfSignedCertificate(host, port)
if err != nil {
    if strings.HasPrefix(err.Error(), "failed to get TLS certificate for:") {
        log.Printf("cert fetch failed for %s:%d — check phishlet hostname config and upstream: %v", host, port, err)
    }
    return nil, err
}

Prevention

Set and enable the phishlet hostname before traffic flows
Verify host DNS and upstream port reachability
Keep certificates cached/pre-provisioned for proxied hosts
Read the wrapped error text for the root cause before retrying

When it happens

Trigger: Requesting a TLS certificate for a host whose certificate is not cached/managed and the TLS connection to host:port fails — wrong port, host not proxied/enabled in phishlets, network unreachable, or upstream presents an unusable certificate.

Common situations: Misconfigured phishlet hostname that doesn't resolve; upstream server offline or blocking; testing against hosts not defined in any phishlet; DNS failures in containers; wrong port in the host:port pair.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/c006184f439691e4. Report an issue: GitHub.