tailscale/tailscale · warning

find identity: %w

Error message

find identity: %w

What it means

findIdentity failed while signing a RegisterRequest: either st.Identities() returned an error, or no identity matched — errNoMatch ('no matching certificate'). A match requires an RSA certificate (isSupportedCertificate), currently within its validity window, whose chain (leaf, intermediate, or root) contains a Subject exactly equal to the configured MachineCertificateSubject string.

Source

Thrown at control/controlclient/sign_supported.go:162

	if req.Timestamp == nil {
		return errBadRequest
	}

	machineCertificateSubject := getMachineCertificateSubject(polc)
	if machineCertificateSubject == "" {
		return errCertificateNotConfigured
	}

	st, err := certstore.Open(certstore.System)
	if err != nil {
		return fmt.Errorf("open cert store: %w", err)
	}
	defer st.Close()

	id, chain, err := findIdentity(machineCertificateSubject, st)
	if err != nil {
		return fmt.Errorf("find identity: %w", err)
	}
	defer id.Close()

	signer, err := id.Signer()
	if err != nil {
		return fmt.Errorf("create signer: %w", err)
	}

	cl := 0
	for _, c := range chain {
		cl += len(c.Raw)
	}
	req.DeviceCert = make([]byte, 0, cl)
	for _, c := range chain {
		req.DeviceCert = append(req.DeviceCert, c.Raw...)
	}

	req.SignatureType = tailcfg.SignatureV2

View on GitHub (pinned to 6e0912f979)

Solutions

1. Verify MachineCertificateSubject matches the chain's Subject exactly as pkix.Name.String() renders it, including RDN order
2. Confirm the machine certificate is RSA, present in the system store, and currently valid
3. Renew expired machine certificates via MDM
4. Note the subject may match any cert in the chain (leaf, intermediate, or root) — widen the search accordingly

// verify subject formatting matches pkix.Name.String() before policy deploy
want := "CN=Tailscale Inc Test Root CA,OU=...,O=...,ST=ON,C=CA"
for _, c := range chain {
    if c.Subject.String() == want && c.PublicKeyAlgorithm == x509.RSA && now.After(c.NotBefore) && now.Before(c.NotAfter) {
        return nil // match guaranteed
    }
}

func isNoMatchingCert(err error) bool {
    return err != nil && strings.HasSuffix(err.Error(), "no matching certificate")
}

When it happens

Trigger: Policy subject string not matching pkix.Name.String() formatting exactly (wrong ordering, spacing, or missing RDNs); machine cert expired or not yet valid; cert replaced with an ECDSA one; subject configured to match the leaf but only present on a cert not in the store.

Common situations: MDM subject copied from docs with different attribute ordering; certs rotated to non-RSA algorithms; expired machine certificates on long-lived devices.

Related errors

• signRegisterRequest: %w
• no matching certificate
• open cert store: %w
• create signer: %w
• hash: %w

AI-assisted analysis of tailscale/tailscale@6e0912f979 (2026-08-18). Data as JSON: /api/errors/dea3cd2bfa412d5c. Report an issue: GitHub.