{"record":{"id":"045eadbd7cadd397","repo":"caddyserver/caddy","slug":"automate-manage-v-v","errorCode":null,"errorMessage":"automate: manage %v: %v","messagePattern":"automate: manage (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":592,"sourceCode":"\t\tif t.managingWildcardFor(subj, subjects) {\n\t\t\tif _, ok := t.automateNames[subj]; !ok {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t}\n\t\tpolicyToNames[ap] = append(policyToNames[ap], subj)\n\t}\n\n\t// now that names are grouped by policy, we can simply make one\n\t// certmagic.Config for each (potentially large) group of names\n\t// and call ManageAsync just once for the whole batch\n\tfor ap, names := range policyToNames {\n\t\terr := ap.magic.ManageAsync(t.ctx.Context, names)\n\t\tif err != nil {\n\t\t\tconst maxNamesToDisplay = 100\n\t\t\tif len(names) > maxNamesToDisplay {\n\t\t\t\tnames = append(names[:maxNamesToDisplay], fmt.Sprintf(\"(and %d more...)\", len(names)-maxNamesToDisplay))\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"automate: manage %v: %v\", names, err)\n\t\t}\n\t\tfor _, name := range names {\n\t\t\t// certs that are issued solely by our internal issuer are a little bit of\n\t\t\t// a special case: if you have an initial config that manages example.com\n\t\t\t// using internal CA, then after testing it you switch to a production CA,\n\t\t\t// you wouldn't want to keep using the same self-signed cert, obviously;\n\t\t\t// so we differentiate these by associating the subject with its issuer key;\n\t\t\t// we do this because CertMagic has no notion of \"InternalIssuer\" like we\n\t\t\t// do, so we have to do this logic ourselves\n\t\t\tvar issuerKey string\n\t\t\tif len(ap.Issuers) == 1 {\n\t\t\t\tif intIss, ok := ap.Issuers[0].(*InternalIssuer); ok && intIss != nil {\n\t\t\t\t\tissuerKey = intIss.IssuerKey()\n\t\t\t\t}\n\t\t\t}\n\t\t\tt.managing[name] = issuerKey\n\t\t}\n\t}","sourceCodeStart":574,"sourceCodeEnd":610,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L574-L610","documentation":"Inside TLS.Manage, names are grouped by automation policy and each group is managed asynchronously via ap.magic.ManageAsync. If asynchronous management of a batch fails (challenge failures, issuer errors, context cancellation during shutdown), that error is wrapped here; for readability only the first 100 names are listed with '(and N more...)'.","triggerScenarios":"A batch of subjects under one policy where one or more fail issuance/renewal: unreachable HTTP challenge port, DNS propagation timeout, rate-limited ACME account, expired DNS provider credentials. Can also surface at config reload when renewals are re-checked for all managed names.","commonSituations":"Bulk-managing many domains where a single failing domain aborts the group's report; renewals breaking after credentials rotate; transient network failure at startup; context cancelled by an immediate subsequent config change.","solutions":["Inspect the wrapped certmagic error for per-domain cause (challenge type, rate limit URLs, DNS errors)","Fix the specific failing domain's reachability/DNS, or move it to its own policy with the internal issuer if it is not publicly valid","Retry after transient network issues — issuance is retried with backoff while Caddy runs; consider 'caddy reload' to retrigger","Use staging CA during bulk testing to avoid production rate limits"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Monitor the wrapped certmagic log lines; Caddy retries failed issuances with backoff while running","Isolate problematic domains into their own policy so one failure does not dominate a batch","Keep DNS provider credentials current and use staging CA during bulk tests"],"tags":["caddy","tls","acme","manage","certificate-renewal"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}