router-for-me/CLIProxyAPI · error

certificate id is required

Error message

certificate id is required

What it means

Returned by createClientCSR in internal/home/certificate.go when the certificate ID, after trimming whitespace, is empty. The CSR's CommonName is the certificate ID used by the home server to identify this client, so it is mandatory during enrollment.

Source

Thrown at internal/home/certificate.go:287

	case "PRIVATE KEY":
		key, errParse := x509.ParsePKCS8PrivateKey(block.Bytes)
		if errParse != nil {
			return nil, errParse
		}
		rsaKey, ok := key.(*rsa.PrivateKey)
		if !ok {
			return nil, fmt.Errorf("client key is not rsa")
		}
		return rsaKey, nil
	default:
		return nil, fmt.Errorf("client key pem type %q is unsupported", block.Type)
	}
}

func createClientCSR(certificateID string, key *rsa.PrivateKey) ([]byte, error) {
	certificateID = strings.TrimSpace(certificateID)
	if certificateID == "" {
		return nil, fmt.Errorf("certificate id is required")
	}
	template := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName: certificateID,
		},
	}
	der, errCreate := x509.CreateCertificateRequest(rand.Reader, template, key)
	if errCreate != nil {
		return nil, errCreate
	}
	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: der}), nil
}

func requestClientCertificate(ctx context.Context, claims homeJWTClaims, csrPEM []byte) (certificateRequestResponse, error) {
	var response certificateRequestResponse
	if ctx == nil {
		ctx = context.Background()
	}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Set a non-empty certificate ID in the enrollment configuration/claims
2. If driven by a script, guard: : "${CERT_ID:?certificate id required}" before invoking the tool

Example fix

# before
home:
  enrollment:
    certificate-id: ""

# after
home:
  enrollment:
    certificate-id: "proxy-node-01"

if strings.TrimSpace(cfg.Enrollment.CertificateID) == "" {
    return errors.New("certificate-id is required for enrollment")
}

When it happens

Trigger: Calling the enrollment/cert-issuance flow with an empty or whitespace-only certificate ID — usually a missing or blanked id field in the enrollment config or claims.

Common situations: Enrollment config template left the certificate-id field empty; automation script passed an unset variable ($CERT_ID empty under set -u absent); ID was read from an env var not exported in CI.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• home ca fingerprint is required
• home certificate request failed
• home certificate request returned nil
• home certificate request returned unsupported resp prefix %q
• home: invalid address (host=%q port=%d)

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/ed3861f763b24087. Report an issue: GitHub.