{"record":{"id":"0fa35a30991c9514","repo":"caddyserver/caddy","slug":"trust-pool-module-s-is-not-a-certificate-pool-p","errorCode":null,"errorMessage":"trust_pool module '%s' is not a certificate pool provider","messagePattern":"trust_pool module '(.+?)' is not a certificate pool provider","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":720,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn d.WrapErr(err)\n\t\t\t}\n\t\t\tca.TrustedLeafCerts = append(ca.TrustedLeafCerts, ders...)\n\t\tcase \"trust_pool\":\n\t\t\tif len(ca.TrustedCACerts) != 0 {\n\t\t\t\treturn d.Err(\"cannot specify both 'trust_pool' and 'trusted_ca_cert' or 'trusted_ca_cert_file'\")\n\t\t\t}\n\t\t\tif !d.NextArg() {\n\t\t\t\treturn d.ArgErr()\n\t\t\t}\n\t\t\tmodName := d.Val()\n\t\t\tmod, err := caddyfile.UnmarshalModule(d, \"tls.ca_pool.source.\"+modName)\n\t\t\tif err != nil {\n\t\t\t\treturn d.WrapErr(err)\n\t\t\t}\n\t\t\tcaMod, ok := mod.(CA)\n\t\t\tif !ok {\n\t\t\t\treturn fmt.Errorf(\"trust_pool module '%s' is not a certificate pool provider\", caMod)\n\t\t\t}\n\t\t\tca.CARaw = caddyconfig.JSONModuleObject(caMod, \"provider\", modName, nil)\n\t\tcase \"verifier\":\n\t\t\tif !d.NextArg() {\n\t\t\t\treturn d.ArgErr()\n\t\t\t}\n\n\t\t\tvType := d.Val()\n\t\t\tmodID := \"tls.client_auth.verifier.\" + vType\n\t\t\tunm, err := caddyfile.UnmarshalModule(d, modID)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\t_, ok := unm.(ClientCertificateVerifier)\n\t\t\tif !ok {\n\t\t\t\treturn d.Errf(\"module '%s' is not a caddytls.ClientCertificateVerifier\", modID)\n\t\t\t}","sourceCodeStart":702,"sourceCodeEnd":738,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L702-L738","documentation":"Returned by UnmarshalCaddyfile for client_auth's trust_pool subdirective when the module unmarshaled from tls.ca_pool.source.<name> does not implement the CA interface. Note the message itself is buggy: it formats caMod (a nil-typed interface value) with %s instead of modName, so the name in the message is useless — identify the module from your config instead.","triggerScenarios":"Writing 'trust_pool <name>' where <name> resolves to a module registered under tls.ca_pool.source but not implementing CA (e.g. a plugin registering a colliding name, or an internal module misused here). Typically only possible with custom builds, since stock source modules (file, inline, combined, root, pki) all implement CA.","commonSituations":"xcaddy plugin registering a module in the ca_pool namespace without implementing the CA interface; typo happens to match a non-CA module; version skew after a plugin changed its module type.","solutions":["Look at the argument after 'trust_pool' in your Caddyfile — that is the module name that failed the check (ignore the garbage in the message itself)","Run 'caddy list-modules' and verify the tls.ca_pool.source.<name> module implements the CA pool provider interface","Fix or update the plugin so its module implements CA (Certificates/CACertificates etc.), or use a stock provider","Use 'file', 'inline', 'pki', or 'combined' if they fit your use case"],"exampleFix":"# before\nclient_auth {\n\ttrust_pool mybrokenplugin\n}\n\n# after\nclient_auth {\n\ttrust_pool file /etc/caddy/client-cas.pem\n}","handlingStrategy":"type-guard","validationCode":"# Before deploying a config with a custom trust_pool provider:\ncaddy list-modules --packages caddytls | grep 'ca_pool'","typeGuard":"// Compile-time guard for plugin authors implementing a trust pool source:\nvar _ caddytls.CA = (*MyPoolSource)(nil)","tryCatchPattern":null,"preventionTips":["Plugin authors: add the CA interface guard so this failure is impossible to compile","Operators: use stock providers (file, inline, pki, combined) unless a plugin is required","On plugin upgrades, run 'caddy list-modules' and smoke-test client_auth before rolling out"],"tags":["caddy","tls","client-auth","trust-pool","plugin","caddyfile"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}