What causes "home certificate request returned nil" in router-for-me/CLIProxyAPI?

Confirm you are connecting to the correct home server address/port from the config

home certificate request returned nil

Error message

home certificate request returned nil

What it means

Returned by readRESPBulk in internal/home/certificate.go while parsing the home server's RESP reply: the reply started with '$' (bulk string) but the declared size parsed to a negative number. In RESP, $-1 is the canonical nil bulk reply, so this means the server answered 'nil' — typically because the requested key/enrollment record does not exist on that node.

Source

Thrown at internal/home/certificate.go:366

}

func readRESPBulk(reader *bufio.Reader) ([]byte, error) {
	prefix, errRead := reader.ReadByte()
	if errRead != nil {
		return nil, errRead
	}
	switch prefix {
	case '$':
		line, errLine := reader.ReadString('\n')
		if errLine != nil {
			return nil, errLine
		}
		size, errSize := strconv.Atoi(strings.TrimSpace(line))
		if errSize != nil {
			return nil, errSize
		}
		if size < 0 {
			return nil, fmt.Errorf("home certificate request returned nil")
		}
		payload := make([]byte, size+2)
		if _, errFull := io.ReadFull(reader, payload); errFull != nil {
			return nil, errFull
		}
		return payload[:size], nil
	case '-':
		line, errLine := reader.ReadString('\n')
		if errLine != nil {
			return nil, errLine
		}
		return nil, fmt.Errorf("%s", strings.TrimSpace(line))
	default:
		return nil, fmt.Errorf("home certificate request returned unsupported resp prefix %q", prefix)
	}
}

func fileExists(path string) bool {

View on GitHub (pinned to 78f0c4079e)

Solutions

Confirm you are connecting to the correct home server address/port from the config
Retry against the primary node or wait for replication if you hit a replica
Re-register the certificate ID / enrollment secret on the server so the record exists

Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "home certificate request returned nil") {
    // nil bulk reply: record absent on this node; retry against primary or after re-registration
    time.Sleep(time.Second)
    return requestCertificate(ctx, csrPEM) // bounded retry
}

Prevention

Direct enrollment traffic at the home primary node, not replicas
Register the enrollment record before clients start requesting certificates

When it happens

Trigger: Sending CERTIFICATE REQUEST (or any bulk-string request) to a home/Redis node that has no record of the item — e.g. certificate ID unknown, data not yet replicated to the node you reached, or a misrouted connection to a bare Redis instance without the home schema.

Common situations: Enrollment secret/certificate entry not yet propagated to the queried replica; pointing the client at the wrong host:port (a plain Redis, not the home server); the enrollment record expired on the server.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/adf0f7495f464c22. Report an issue: GitHub.