{"record":{"id":"0b203ecced93965b","repo":"caddyserver/caddy","slug":"no-certificate-authority-configured-with-id-s","errorCode":null,"errorMessage":"no certificate authority configured with id: %s","messagePattern":"no certificate authority configured with id: (.+?)","errorType":"http","errorClass":"caddy.APIError","httpStatus":404,"severity":"info","filePath":"modules/caddypki/adminapi.go","lineNumber":201,"sourceCode":"\n\t// Find the CA by ID, if PKI is configured\n\tvar ca *CA\n\tvar ok bool\n\tif a.pkiApp != nil {\n\t\tca, ok = a.pkiApp.CAs[id]\n\t}\n\n\t// If we didn't find the CA, and PKI is not configured\n\t// then we'll either error out if the CA ID is not the\n\t// default. If the CA ID is the default, then we'll\n\t// provision it, because the user probably aims to\n\t// change their config to enable PKI immediately after\n\t// if they actually requested the local CA ID.\n\tif !ok {\n\t\tif id != DefaultCAID {\n\t\t\treturn nil, caddy.APIError{\n\t\t\t\tHTTPStatus: http.StatusNotFound,\n\t\t\t\tErr:        fmt.Errorf(\"no certificate authority configured with id: %s\", id),\n\t\t\t}\n\t\t}\n\n\t\t// Provision the default CA, which generates and stores a root\n\t\t// certificate in storage, if one doesn't already exist.\n\t\tca = new(CA)\n\t\terr := ca.Provision(a.ctx, id, a.log)\n\t\tif err != nil {\n\t\t\treturn nil, caddy.APIError{\n\t\t\t\tHTTPStatus: http.StatusInternalServerError,\n\t\t\t\tErr:        fmt.Errorf(\"failed to provision CA %s, %w\", id, err),\n\t\t\t}\n\t\t}\n\t}\n\n\treturn ca, nil\n}\n","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/adminapi.go#L183-L219","documentation":"A 404 caddy.APIError returned when the requested CA id is not configured in the running pki app and is not the default id (`local`). The admin API refuses to conjure arbitrary CAs on demand; only the default CA gets lazily provisioned. The message includes the exact id that was not found.","triggerScenarios":"GET /pki/ca/myca when the config's pki.certificate_authorities has no `myca` entry (or the pki app isn't configured at all). The lookup a.pkiApp.CAs[id] misses, id != DefaultCAID, and the 404 is returned.","commonSituations":"Querying a CA id defined in a different environment; typo in the id; the pki app config section was renamed/removed during a refactor; acme_server referencing a custom CA that isn't declared under pki.certificate_authorities.","solutions":["List configured CAs: GET /pki/ca only routes known ids — inspect the running config via GET /config/ to see pki.certificate_authorities keys","Add the CA to config (pki app, certificate_authorities.<id>) and reload, then retry","Use the default id `local`, which provisions on demand","Fix the id typo — ids are case-sensitive"],"exampleFix":"# before: 'myca' not in config\ncurl http://localhost:2019/pki/ca/myca   # 404\n\n# after: declare it, then query\ncat caddy.json  # \"pki\": {\"certificate_authorities\": {\"myca\": {}}}\ncurl -X PUT http://localhost:2019/load -H 'Content-Type: application/json' -d @caddy.json\ncurl http://localhost:2019/pki/ca/myca","handlingStrategy":"validation","validationCode":"// Compare requested id against configured CAs before calling:\nfunc caExists(base, id string) bool {\n    resp, err := http.Get(base + \"/config/pki/certificate_authorities\")\n    if err != nil { return false }\n    defer resp.Body.Close()\n    var m map[string]json.RawMessage\n    json.NewDecoder(resp.Body).Decode(&m)\n    _, ok := m[id]\n    return ok || id == \"local\"\n}","typeGuard":"func isKnownCA(id string, configured map[string]bool) bool {\n    return configured[id] || id == \"local\"\n}","tryCatchPattern":"// 404 here is a config gap, not transient — do not retry:\nif resp.StatusCode == 404 {\n    return fmt.Errorf(\"CA %q not configured; add it under pki.certificate_authorities\", id)\n}","preventionTips":["Declare every CA you intend to query under pki.certificate_authorities","Remember only `local` auto-provisions via the admin API","CA ids are case-sensitive; use them verbatim from config"],"tags":["pki","admin-api","http-404","config"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}