tailscale/tailscale · error

invalid domain

Error message

invalid domain

What it means

Error "invalid domain" thrown in tailscale/tailscale.

Source

Thrown at feature/acme/cert.go:99

func (e *extension) getCertPEMWithValidity(ctx context.Context, b *ipnlocal.LocalBackend, domain string, minValidity time.Duration) (*ipnlocal.TLSCertKeyPair, error) {
	e.mu.Lock()
	getCertForTest := e.getCertForTest
	e.mu.Unlock()

	if getCertForTest != nil {
		testenv.AssertInTest()
		return getCertForTest(domain)
	}

	// Trim a trailing dot from the domain (e.g. from an SNI ServerName of
	// "host.ts.net.") before lookup. Per RFC 6066 §3 the SNI HostName has
	// no trailing dot, but some clients send a fully-qualified name with
	// one, and cert store names have no trailing dot. See
	// https://github.com/tailscale/tailscale/issues/10233.
	domain = strings.TrimSuffix(domain, ".")

	if !validLookingCertDomain(domain) {
		return nil, errors.New("invalid domain")
	}

	certDomain, err := e.resolveCertDomain(b, domain)
	if err != nil {
		return nil, err
	}
	logf := logger.WithPrefix(b.Logger(), fmt.Sprintf("cert(%q): ", domain))
	now := b.Clock().Now()
	traceACME := func(v any) {
		if !acmeDebug() {
			return
		}
		j, _ := json.MarshalIndent(v, "", "\t")
		log.Printf("acme %T: %s", v, j)
	}

	cs, err := e.getCertStore(b)
	if err != nil {

View on GitHub (pinned to cfe32b8be6)

When it happens

Trigger: Thrown at feature/acme/cert.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of tailscale/tailscale@cfe32b8be6 (2026-08-15). Data as JSON: /api/errors/339f99e8213908e5. Report an issue: GitHub.