{"record":{"id":"29e36ed02aedb868","repo":"valyala/fasthttp","slug":"cannot-determine-tls-server-name-from-addr-q-w","errorCode":null,"errorMessage":"cannot determine tls server name from addr %q: %w","messagePattern":"cannot determine tls server name from addr %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client.go","lineNumber":2201,"sourceCode":"\t} else {\n\t\tc.readerPool.Put(br)\n\t}\n}\n\nfunc newClientTLSConfig(c *tls.Config, addr string) (*tls.Config, error) {\n\tif c == nil {\n\t\tc = &tls.Config{}\n\t} else {\n\t\tc = c.Clone()\n\t}\n\n\tif c.ServerName == \"\" {\n\t\tserverName, err := tlsServerName(addr)\n\t\tif err != nil {\n\t\t\tif c.InsecureSkipVerify {\n\t\t\t\treturn c, nil\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"cannot determine tls server name from addr %q: %w\", addr, err)\n\t\t}\n\t\tc.ServerName = serverName\n\t}\n\treturn c, nil\n}\n\nfunc tlsServerName(addr string) (string, error) {\n\tif !strings.Contains(addr, \":\") {\n\t\treturn addr, nil\n\t}\n\thost, _, err := net.SplitHostPort(addr)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\treturn host, nil\n}\n\nfunc (c *HostClient) nextAddr() string {","sourceCodeStart":2183,"sourceCodeEnd":2219,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/client.go#L2183-L2219","documentation":"When building the TLS config for a connection, fasthttp must derive the TLS ServerName (for SNI and certificate verification) from the dial address. If tlsServerName fails (e.g. the addr is an IP or unparseable) and no ServerName is configured and InsecureSkipVerify is false, this error is returned.","triggerScenarios":"Dialing an HTTPS host by raw IP address, or an address string that cannot yield a DNS name, while TLS verification is enabled and TLSConfig.ServerName is empty.","commonSituations":"Connecting to https://127.0.0.1:8443 or https://10.0.0.5 in dev/test environments, service discovery returning IPs, custom dialers passing odd address formats.","solutions":["Set TLSConfig.ServerName explicitly to the certificate's DNS name","Dial using the hostname instead of the IP","If this is intentional (dev/test), set InsecureSkipVerify: true in TLSConfig (never in production)","Provide a custom TLSConfig via HostClient.TLSConfig with proper RootCAs"],"exampleFix":"// before\nhc := &fasthttp.HostClient{Addr: \"10.0.0.5:443\", IsTLS: true} // no ServerName\n// after\nhc := &fasthttp.HostClient{\n    Addr:  \"10.0.0.5:443\",\n    IsTLS: true,\n    TLSConfig: &tls.Config{ServerName: \"api.example.com\"},\n}","handlingStrategy":"fallback","validationCode":"if net.ParseIP(hostOnly(addr)) != nil && tlsCfg.ServerName == \"\" {\n    return errors.New(\"dialing TLS by IP requires TLSConfig.ServerName\")\n}","typeGuard":null,"tryCatchPattern":"c, err := client.Do(req, resp) // or dial\nif err != nil {\n    if strings.Contains(err.Error(), \"cannot determine tls server name\") {\n        // retry with a HostClient that sets TLSConfig.ServerName\n    }\n}","preventionTips":["Always set TLSConfig.ServerName when dialing by IP","Prefer hostnames over IPs for TLS endpoints","Only enable InsecureSkipVerify in test environments"],"tags":["go","tls","sni","fasthttp"],"backgroundTag":"tls-server-name-missing","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}