Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

key cannot be loaded due to wrong format

Open
  • Is something wrong?
#1,421 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@eshentials is already working on this.

Since Sep 11, 2025.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
docker, go, postgresql
Domain
security

Research direction

Reproduce the Dockerfile's cfssl gencert flow using csr_timescaledb.json, csr_client.json, and cfssl-config.json, then inspect the generated key files and compare them with the OpenSSL setup linked in the issue. Check how the resulting certificates and keys are consumed by PostgreSQL; done means identifying whether cfssl produced an incompatible format or whether the PostgreSQL configuration is the cause.

Written by the indexing model from the issue text.

Description

Hi, I have the following Dockerfile to generate the certs:

FROM golang:1.20-alpine AS builder

RUN set -x && \
    apk --no-cache add git gcc libc-dev make && \
    # Create postgres user without specific GID/UID
    addgroup postgres && \
    adduser -S -G postgres postgres

RUN go install github.com/cloudflare/cfssl/cmd/...@latest

WORKDIR /app
COPY docker/volumes/timescaledb/certs/csr_timescaledb.json /app/csr_timescaledb.json
COPY docker/volumes/timescaledb/certs/csr_client.json /app/csr_client.json
COPY docker/volumes/timescaledb/certs/cfssl-config.json /app/cfssl-config.json

# Create directories for certificates
RUN mkdir -p /output && \
    chown -R postgres:postgres /output

# Generate CA certificate
RUN cfssl gencert -initca /app/csr_timescaledb.json | cfssljson -bare ca

# Generate server certificate
RUN cfssl gencert \
    -ca ca.pem \
    -ca-key ca-key.pem \
    -config=/app/cfssl-config.json \
    /app/csr_timescaledb.json | cfssljson -bare server

# Generate client certificate
RUN cfssl gencert \
    -ca ca.pem \
    -ca-key ca-key.pem \
    -config=/app/cfssl-config.json \
    /app/csr_client.json | cfssljson -bare client

# Set proper permissions
RUN chmod 400 ca-key.pem server-key.pem client-key.pem && \
    chmod 644 ca.pem server.pem client.pem

# Copy all certificates to output directory
RUN cp ca.pem client.pem client-key.pem server.pem server-key.pem /output/ && \
    chmod 600 /output/client-key.pem /output/server-key.pem && \
    chmod 644 /output/ca.pem /output/client.pem /output/server.pem && \
    chown -R postgres:postgres /output

USER postgres
WORKDIR /app

CMD ["sh", "-c", "cp -v /output/* /certs-output/ && exit 0"]

compare to what I did with just openssl here: https://goteleport.com/blog/securing-postgres-postgresql/ I can make ssl to my postgres instance.

Did I do something wrong? or is there any reason why the format is wrong?

For more contex, I have put question in here: https://dba.stackexchange.com/questions/346355/running-postgresql-container-using-sslmode-verify-full-and-accessing-from-wsl-b?noredirect=1#comment672692_346355

Dominant language
Go
Stars
9.5k
Forks
1.2k
Avg merge
5d 1h
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/cfssl

All issues in cloudflare/cfssl

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.