{"record":{"id":"20b5b537adc9908f","repo":"coredns/coredns","slug":"loading-managed-certificates-for-q-w","errorCode":null,"errorMessage":"loading managed certificates for %q: %w","messagePattern":"loading managed certificates for %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/tls/acme.go","lineNumber":385,"sourceCode":"\tctx, cancel := context.WithCancel(context.Background())\n\tfor _, entry := range entries {\n\t\tmanager := backend.Manager(entry.key)\n\t\tif manager == nil {\n\t\t\tcancel()\n\t\t\tbackend.Stop()\n\t\t\tfor _, configured := range entries {\n\t\t\t\tconfigured.setManager(nil)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"no ACME certificate manager for %q\", entry.options.domains)\n\t\t}\n\t\tentry.setManager(manager)\n\t\tif err := manager.LoadManaged(ctx, entry.options.domains); err != nil {\n\t\t\tcancel()\n\t\t\tbackend.Stop()\n\t\t\tfor _, configured := range entries {\n\t\t\t\tconfigured.setManager(nil)\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"loading managed certificates for %q: %w\", entry.options.domains, err)\n\t\t}\n\t}\n\tr.backend = backend\n\tr.cancel = cancel\n\tr.started = true\n\tvar errs []error\n\tfor _, entry := range entries {\n\t\tentry.mu.RLock()\n\t\tmanager := entry.manager\n\t\tentry.mu.RUnlock()\n\t\tif err := manager.ManageAsync(ctx, entry.options.domains); err != nil {\n\t\t\terrs = append(errs, fmt.Errorf(\"starting ACME management for %q: %w\", entry.options.domains, err))\n\t\t}\n\t}\n\treturn errors.Join(errs...)\n}\n\nfunc (r *acmeRuntime) stop() error {","sourceCodeStart":367,"sourceCodeEnd":403,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/tls/acme.go#L367-L403","documentation":"start() calls manager.LoadManaged to restore already-issued certificates from storage; if that fails, startup unwinds (stops backend, clears managers) and returns this wrapped error, preserving the underlying cause (e.g. storage or PEM parse failure).","triggerScenarios":"certmagic storage contains corrupt/unreadable certificate assets for the entry's domains, or the storage backend is unreachable during LoadManaged.","commonSituations":"Corrupted cert.pem/key.pem in the storage dir after a crashed write; permissions changed on the storage path; switched storage backends losing sync.","solutions":["Inspect the wrapped underlying error for the failing domain/asset and repair the storage (delete corrupt certs to force reissue)","Fix permissions/read access on the certmagic storage directory","Verify the storage backend (file path/S3 etc.) is reachable with correct credentials"],"exampleFix":"// before\n// storage dir /data/certs owned by root, service runs as nobody\n// after\nchown -R nobody:nobody /data/certs  # or run service as owner","handlingStrategy":"try-catch","validationCode":"// preflight storage access\nst := certmagic.FileStorage{Path: cfg.StoragePath}\nif _, err := st.Stat(ctx, \"\"); err != nil { return fmt.Errorf(\"storage unreadable: %w\", err) }","typeGuard":null,"tryCatchPattern":"if err := runtime.start(ctx); err != nil {\n  var wrapped interface{ Unwrap() error }\n  log.Printf(\"start failed: %v\", err) // inspect \"loading managed certificates for\" cause\n  // optionally clear corrupt assets for the failing domain, then retry\n  return err\n}","preventionTips":["Back up and fsync cert storage writes; avoid killing the process mid-write","Run the service as a user with read access to the storage dir","Monitor the wrapped error's cause for storage/PEM issues"],"tags":["acme","storage","certificate-loading"],"backgroundTag":"file-read-failed","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}