{"record":{"id":"0664401d610cdd08","repo":"juanfont/headscale","slug":"no-cert-domains-available-for-https","errorCode":null,"errorMessage":"no cert domains available for HTTPS","messagePattern":"no cert domains available for HTTPS","errorType":"console","errorClass":"ErrNoCertDomains","httpStatus":null,"severity":"warning","filePath":"hscontrol/tailsql.go","lineNumber":17,"sourceCode":"package hscontrol\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"os\"\n\n\t\"github.com/tailscale/tailsql/server/tailsql\"\n\t\"tailscale.com/tsnet\"\n\t\"tailscale.com/tsweb\"\n\t\"tailscale.com/types/logger\"\n)\n\n// ErrNoCertDomains is returned when no cert domains are available for HTTPS.\nvar ErrNoCertDomains = errors.New(\"no cert domains available for HTTPS\")\n\nfunc runTailSQLService(ctx context.Context, logf logger.Logf, stateDir, dbPath string) error {\n\topts := tailsql.Options{\n\t\tHostname: \"tailsql-headscale\",\n\t\tStateDir: stateDir,\n\t\tSources: []tailsql.DBSpec{\n\t\t\t{\n\t\t\t\tSource: \"headscale\",\n\t\t\t\tLabel:  \"headscale - sqlite\",\n\t\t\t\tDriver: \"sqlite\",\n\t\t\t\tURL:    fmt.Sprintf(\"file:%s?mode=ro\", dbPath),\n\t\t\t\tNamed: map[string]string{\n\t\t\t\t\t\"schema\": `select * from sqlite_schema`,\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}\n","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/tailsql.go#L1-L35","documentation":"ErrNoCertDomains is a sentinel error in hscontrol/tailsql.go:17 returned at tailsql.go:76 when the embedded tailsql tsnet node has ServeHTTPS enabled but tsNode.CertDomains() returns an empty list, so no TLS certificate domain is available to build the HTTPS base URL for the TailSQL UI.","triggerScenarios":"Enabling the tailsql debug feature with HTTPS serving while the tsnet node has no provisioned cert domain — typically because MagicDNS/HTTPS certificates are not enabled on the tailnet, the node is not authorized, or the control plane advertises no DNSConfig.CertDomains.","commonSituations":"Running headscale's tailsql integration against a tailnet where HTTPS certs (LetsEncrypt via tailnet name) are disabled; tailnet not fully joined yet when CertDomains is queried; base_domain/MagicDNS misconfiguration so no cert domain is advertised.","solutions":["Enable MagicDNS and HTTPS certificate provisioning on the tailnet so CertDomains is non-empty","Verify the tailsql tsnet node is authorized and reaches Running state before checking CertDomains","Alternatively disable HTTPS serving for tailsql and use plain HTTP/port 80","Check dns.magic_dns and base_domain settings in the headscale config"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// Enable tailsql HTTPS only when the tailnet advertises cert domains\nif len(tsNode.CertDomains()) == 0 {\n    opts.ServeHTTPS = false\n}","typeGuard":"null","tryCatchPattern":"if errors.Is(err, ErrNoCertDomains) { /* fall back to HTTP or enable MagicDNS/HTTPS certs on the tailnet */ }","preventionTips":["Enable MagicDNS and HTTPS certificate provisioning before turning on tailsql TLS","Verify the tailsql node is authorized and Running before querying CertDomains"],"tags":["headscale","tailsql","tls","https","magicdns"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}