tailscale/tailscale · error

acmeKey: %w

Error message

acmeKey: %w

What it means

Raised by acmeClient when loading or creating the ACME account key from the cert store fails. It wraps the store or key generation error; without the account key no ACME client can be built.

Source

Thrown at feature/acme/certstore.go:394

	privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		return nil, err
	}
	var pemBuf bytes.Buffer
	if err := encodeECDSAKey(&pemBuf, privKey); err != nil {
		return nil, err
	}
	if err := cs.WriteACMEKey(pemBuf.Bytes()); err != nil {
		return nil, err
	}
	return privKey, nil
}

func (e *extension) acmeClient(cs certStore) (*xacme.Client, error) {
	key, err := e.acmeKey(cs)
	if err != nil {
		return nil, fmt.Errorf("acmeKey: %w", err)
	}
	// Note: if we add support for additional ACME providers (other than
	// LetsEncrypt), we should make sure that they support ARI extension (see
	// shouldStartDomainRenewalARI).
	return &xacme.Client{
		Key:          key,
		UserAgent:    "tailscaled/" + version.Long(),
		DirectoryURL: envknob.String("TS_DEBUG_ACME_DIRECTORY_URL"),
	}, nil
}

// validCertPEM reports whether the given certificate is valid for
// domain at now.
//
// If roots != nil, it is used instead of the system root pool. This is
// meant to support testing; production code should pass roots == nil.
func validCertPEM(domain string, keyPEM, certPEM []byte, roots *x509.CertPool, now time.Time) bool {
	if len(keyPEM) == 0 || len(certPEM) == 0 {

View on GitHub (pinned to 6e0912f979)

Solutions

1. Check permissions on the cert store directory or state store.
2. Remove a corrupt acme-account.key.pem so a new key is generated.

When it happens

Trigger: Thrown at feature/acme/certstore.go:394 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/7e6249fa659922d3. Report an issue: GitHub.