ory/hydra · error

failed to generate serial number: %s

Error message

failed to generate serial number: %s

What it means

CreateSelfSignedCertificate generates a cryptographically random 128-bit serial number using crypto/rand. This error wraps any failure of rand.Int, which practically only happens when the operating system's random source (/dev/urandom or getrandom) is unavailable or fails. It is an environment/OS-level failure, not a misuse of the API.

Source

Thrown at oryx/tlsx/cert.go:252

		return nil, err
	}

	pemCert := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c.Raw})
	pemKey := pem.EncodeToMemory(block)
	cert, err := tls.X509KeyPair(pemCert, pemKey)
	if err != nil {
		return nil, err
	}

	return &cert, nil
}

// CreateSelfSignedCertificate creates a self-signed x509 certificate.
func CreateSelfSignedCertificate(key interface{}, opts ...CertificateOpts) (cert *x509.Certificate, err error) {
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return cert, errors.Errorf("failed to generate serial number: %s", err)
	}

	certificate := &x509.Certificate{
		SerialNumber: serialNumber,
		Subject: pkix.Name{
			Organization: []string{"ORY GmbH"},
			CommonName:   "ORY",
		},
		Issuer: pkix.Name{
			Organization: []string{"ORY GmbH"},
			CommonName:   "ORY",
		},
		NotBefore:             time.Now().UTC(),
		NotAfter:              time.Now().UTC().Add(time.Hour * 24 * 31),
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth},
		BasicConstraintsValid: true,
		IsCA:                  true,

View on GitHub (pinned to 4174065ffb)

Solutions

1. Fix the environment's random source: mount /dev/urandom in the container and review seccomp profiles to allow getrandom(2).
2. Retry the call — the failure is typically transient if caused by temporary entropy exhaustion.
3. Update the kernel/host: modern Linux (3.17+) getrandom implementations do not block after boot.

if _, err := rand.Int(rand.Reader, big.NewInt(1)); err != nil {
    // environment RNG is broken; surface before calling CreateSelfSignedCertificate
}

cert, err := tlsx.CreateSelfSignedCertificate(key)
if err != nil && strings.Contains(err.Error(), "failed to generate serial number") {
    // RNG failure: check /dev/urandom availability, retry after fixing environment
}

When it happens

Trigger: Calling CreateSelfSignedCertificate (directly or via GetOrCreateTLSCertificate / GenerateTLSCertificateFilesForTests) when crypto/rand.Reader fails to read — e.g. a container with a broken /dev/urandom, seccomp restrictions blocking getrandom(2), or severe kernel entropy exhaustion on old kernels.

Common situations: Hardened Docker/Kubernetes sandboxes with seccomp profiles blocking getrandom; minimal chroots lacking /dev/urandom; legacy VMs with entropy-starved kernels during early boot.

Related errors

• failed to generate private key: %s
• failed to create certificate: %s
• failed to encode private key: %s
• issuer URL scheme must be HTTPS unless development mode is e
• cookiex: at least one secret is required

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/6cc4d2486b89aa7c. Report an issue: GitHub.