{"record":{"id":"04a93422748483f8","repo":"caddyserver/caddy","slug":"hostname-appears-in-more-than-one-automation-polic","errorCode":null,"errorMessage":"hostname appears in more than one automation policy, making certificate management ambiguous: %s","messagePattern":"hostname appears in more than one automation policy, making certificate management ambiguous: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/tlsapp.go","lineNumber":496,"sourceCode":"\t\t\tif len(ap.Issuers) > 0 && ap.IssuersRaw == nil {\n\t\t\t\tfor _, iss := range ap.Issuers {\n\t\t\t\t\tissuerName := iss.(caddy.Module).CaddyModule().ID.Name()\n\t\t\t\t\tap.IssuersRaw = append(ap.IssuersRaw, caddyconfig.JSONModuleObject(iss, \"module\", issuerName, &warnings))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// consolidate automation policies that are the exact same\n\t\ttlsApp.Automation.Policies = consolidateAutomationPolicies(tlsApp.Automation.Policies)\n\n\t\t// ensure automation policies don't overlap subjects (this should be\n\t\t// an error at provision-time as well, but catch it in the adapt phase\n\t\t// for convenience)\n\t\tautomationHostSet := make(map[string]struct{})\n\t\tfor _, ap := range tlsApp.Automation.Policies {\n\t\t\tfor _, s := range ap.SubjectsRaw {\n\t\t\t\tif _, ok := automationHostSet[s]; ok {\n\t\t\t\t\treturn nil, warnings, fmt.Errorf(\"hostname appears in more than one automation policy, making certificate management ambiguous: %s\", s)\n\t\t\t\t}\n\t\t\t\tautomationHostSet[s] = struct{}{}\n\t\t\t}\n\t\t}\n\n\t\t// if nothing remains, remove any excess values to clean up the resulting config\n\t\tif len(tlsApp.Automation.Policies) == 0 {\n\t\t\ttlsApp.Automation.Policies = nil\n\t\t}\n\t\tif reflect.DeepEqual(tlsApp.Automation, new(caddytls.AutomationConfig)) {\n\t\t\ttlsApp.Automation = nil\n\t\t}\n\t}\n\n\treturn tlsApp, warnings, nil\n}\n\ntype acmeCapable interface{ GetACMEIssuer() *caddytls.ACMEIssuer }","sourceCodeStart":478,"sourceCodeEnd":514,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/tlsapp.go#L478-L514","documentation":"After consolidating identical automation policies, the adapter verifies no hostname appears in two different policies; otherwise certificate management (issuers, key type, on-demand, ...) would be ambiguous. It is an adapt-time convenience check of a constraint also enforced at provision time.","triggerScenarios":"Two automation policies with non-identical settings covering the same subject — e.g. 'example.com:443 { tls internal }' and 'example.com:8443 { tls { key_type p256 } }' produce two policies both containing example.com; similar overlaps via snippets defining tls settings imported for the same domain.","commonSituations":"Serving the same hostname on multiple ports with different tls settings; adding global or per-site tls options that repeat hostnames already covered elsewhere; policy shapes that consolidate differently after an upgrade.","solutions":["Make the TLS configuration for the duplicated hostname identical in every block, or consolidate it into one site block.","Manage TLS for each hostname from exactly one config location.","Adapt to JSON ('caddy adapt --pretty') and inspect apps.tls.automation.policies[].subjects to find the overlap."],"exampleFix":"# before\nexample.com {\n  tls internal\n}\nexample.com:8443 {\n  tls {\n    key_type p256\n  }\n}\n\n# after\nexample.com, example.com:8443 {\n  tls {\n    key_type p256\n  }\n}","handlingStrategy":"validation","validationCode":"# inspect consolidated policy subjects to find overlaps before provisioning\ncaddy adapt --config Caddyfile --adapter caddyfile --pretty | jq '.apps.tls.automation.policies[].subjects'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Manage TLS for each hostname from exactly one config location.","After adding tls settings anywhere, adapt and diff the policy subjects list for overlaps."],"tags":["caddyfile","tls","automation-policy","duplicate-hostname"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}