router-for-me/CLIProxyAPI · error

home certificate request returned unsupported resp prefix %q

Error message

home certificate request returned unsupported resp prefix %q

What it means

Returned by readRESPBulk in internal/home/certificate.go when the first byte of the reply is neither '$' (bulk string) nor '-' (error). RESP replies of other types — simple status '+OK', integers ':42', arrays '*1', or garbage from a non-RESP service — hit this default branch, and %q shows the offending prefix byte.

Source

Thrown at internal/home/certificate.go:380

		if errSize != nil {
			return nil, errSize
		}
		if size < 0 {
			return nil, fmt.Errorf("home certificate request returned nil")
		}
		payload := make([]byte, size+2)
		if _, errFull := io.ReadFull(reader, payload); errFull != nil {
			return nil, errFull
		}
		return payload[:size], nil
	case '-':
		line, errLine := reader.ReadString('\n')
		if errLine != nil {
			return nil, errLine
		}
		return nil, fmt.Errorf("%s", strings.TrimSpace(line))
	default:
		return nil, fmt.Errorf("home certificate request returned unsupported resp prefix %q", prefix)
	}
}

func fileExists(path string) bool {
	info, errStat := os.Stat(path)
	return errStat == nil && !info.IsDir()
}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Check the quoted prefix in the message: letters like 'H' (HTTP) or '-' in unexpected positions indicate the wrong endpoint
2. Verify host/port target the home RESP listener, not an HTTP/proxy port
3. Check home server version compatibility for the CERTIFICATE command reply format

// preflight: verify the port speaks RESP before enrolling
conn, err := net.DialTimeout("tcp", addr, 2*time.Second)
if err != nil { return err }
conn.SetReadDeadline(time.Now().Add(2 * time.Second))
buf := make([]byte, 1)
if _, err := io.ReadFull(conn, buf); err == nil && buf[0] != '$' && buf[0] != '-' && buf[0] != '+' {
    return fmt.Errorf("%s does not speak RESP (first byte %q)", addr, buf[0])
}

When it happens

Trigger: The home server replied with a simple status/array/integer where a bulk string was expected, or the connection actually terminated at a non-RESP service (HTTP server, proxy greeting text) so the first byte read is arbitrary ASCII.

Common situations: Port points at an HTTP health endpoint or a TLS-terminating proxy that returns plaintext; server version changed its reply type for the CERTIFICATE command; a TCP proxy injected a banner line before RESP data.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• home certificate request returned nil
• %s
• home ca fingerprint is required
• certificate id is required
• home certificate request failed

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/6f83115238588a74. Report an issue: GitHub.