{"record":{"id":"1f717019a2f84643","repo":"coredns/coredns","slug":"w-q","errorCode":null,"errorMessage":"%w: %q","messagePattern":"%w: %q","errorType":"exception","errorClass":"errACMENameNotManaged","httpStatus":null,"severity":"error","filePath":"plugin/tls/acme.go","lineNumber":262,"sourceCode":"type acmeBackendFactory func([]*acmeEntry, *acmeDNS01Solver) (acmeBackend, error)\n\ntype acmeEntry struct {\n\toptions acmeOptions\n\tkey     acmeConfigKey\n\n\tmu      sync.RWMutex\n\tmanager certificateManager\n}\n\nfunc (e *acmeEntry) setManager(manager certificateManager) {\n\te.mu.Lock()\n\te.manager = manager\n\te.mu.Unlock()\n}\n\nfunc (e *acmeEntry) getCertificate(hello *ctls.ClientHelloInfo) (*ctls.Certificate, error) {\n\tif hello != nil && hello.ServerName != \"\" && !e.manages(hello.ServerName) {\n\t\treturn nil, fmt.Errorf(\"%w: %q\", errACMENameNotManaged, hello.ServerName)\n\t}\n\te.mu.RLock()\n\tmanager := e.manager\n\te.mu.RUnlock()\n\tif manager == nil {\n\t\treturn nil, fmt.Errorf(\"%w for %q\", errACMENotReady, e.options.domains)\n\t}\n\treturn manager.GetCertificate(hello)\n}\n\nfunc (e *acmeEntry) manages(serverName string) bool {\n\tserverName, err := normalizeACMEDomain(serverName)\n\tif err != nil {\n\t\treturn false\n\t}\n\tfor _, domain := range e.options.domains {\n\t\tif certmagic.MatchWildcard(serverName, domain) {\n\t\t\treturn true","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/tls/acme.go#L244-L280","documentation":"The ACME entry's getCertificate callback refuses to issue certificates for names it does not manage. When the TLS ClientHello carries a ServerName that is not in the entry's configured domains, it returns errACMENameNotManaged wrapped with the requested name.","triggerScenarios":"A TLS handshake requests a SNI hostname that is not in any ACME entry's configured domains list managed by this acmeEntry's manager.","commonSituations":"Client connects with a hostname typo, a domain was removed from ACME config but DNS still points at the server, or a wildcard/san variant (e.g. www.) isn't in the domain list.","solutions":["Add the requested hostname to the ACME options' domains list","Check normalizeACMEDomain case/trie-suffix handling — configure domains matching what clients request","Serve a default (fallback) certificate for unmanaged names if intended"],"exampleFix":"// before\ndomains: [\"example.com\"]\n// after\ndomains: [\"example.com\", \"www.example.com\"]","handlingStrategy":"validation","validationCode":"// before handshake handling, ensure requested names are configured\nfor _, name := range requestedNames {\n  if !slices.ContainsFunc(cfg.ACME.Domains, func(d string) bool {\n    return strings.EqualFold(strings.TrimSuffix(d, \".\"), strings.TrimSuffix(name, \".\"))\n  }) {\n    log.Printf(\"name %q not managed by ACME; will get default cert\", name)\n  }\n}","typeGuard":null,"tryCatchPattern":"cert, err := entry.getCertificate(hello)\nif errors.Is(err, errACMENameNotManaged) {\n  // serve fallback/default certificate or reject handshake\n  cert = fallbackCert\n}","preventionTips":["Configure all SAN variants (www., subdomains) in the ACME domains list","Monitor SNI names hitting the server that aren't in config","Keep DNS records and ACME domain config in sync when decommissioning domains"],"tags":["acme","tls","sni"],"backgroundTag":"resource-not-found","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}