{"record":{"id":"2a7e722513b851e5","repo":"caddyserver/caddy","slug":"provisioning-remote-admin-endpoint-v","errorCode":null,"errorMessage":"provisioning remote admin endpoint: %v","messagePattern":"provisioning remote admin endpoint: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"caddy.go","lineNumber":601,"sourceCode":"\n// ProvisionContext creates a new context from the configuration and provisions storage\n// and app modules.\n// The function is intended for testing and advanced use cases only, typically `Run` should be\n// use to ensure a fully functional caddy instance.\n// EXPERIMENTAL: While this is public the interface and implementation details of this function may change.\nfunc ProvisionContext(newCfg *Config) (Context, error) {\n\treturn provisionContext(newCfg, false)\n}\n\n// finishSettingUp should be run after all apps have successfully started.\nfunc finishSettingUp(ctx Context, cfg *Config) error {\n\t// establish this server's identity (only after apps are loaded\n\t// so that cert management of this endpoint doesn't prevent user's\n\t// servers from starting which likely also use HTTP/HTTPS ports;\n\t// but before remote management which may depend on these creds)\n\terr := manageIdentity(ctx, cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"provisioning remote admin endpoint: %v\", err)\n\t}\n\n\t// replace any remote admin endpoint\n\terr = replaceRemoteAdminServer(ctx, cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"provisioning remote admin endpoint: %v\", err)\n\t}\n\n\t// if dynamic config is requested, set that up and run it\n\tif cfg != nil && cfg.Admin != nil && cfg.Admin.Config != nil && cfg.Admin.Config.LoadRaw != nil {\n\t\tval, err := ctx.LoadModule(cfg.Admin.Config, \"LoadRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading config loader module: %s\", err)\n\t\t}\n\n\t\tlogger := Log().Named(\"config_loader\").With(\n\t\t\tzap.String(\"module\", val.(Module).CaddyModule().ID.Name()),\n\t\t\tzap.Int(\"load_delay\", int(cfg.Admin.Config.LoadDelay)))","sourceCodeStart":583,"sourceCodeEnd":619,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddy.go#L583-L619","documentation":"Thrown during finishSettingUp after all apps have started: manageIdentity failed. manageIdentity establishes this server's identity credentials (for remote admin over HTTPS), and its failure is wrapped with this message. It deliberately runs after user apps load so cert management does not block user servers.","triggerScenarios":"Caddy is configured with a remote admin endpoint (admin remote) and the identity management step fails, e.g. unable to provision or renew the identity certificate/credentials from the configured remote management CA or identity module.","commonSituations":"A config with a remote admin section whose identity issuer is unreachable, a PKI app that failed to provision the intermediate/root needed for identity certs, or a read-only/corrupt storage directory preventing identity credential persistence.","solutions":["Check the underlying error text after 'provisioning remote admin endpoint:' to see whether it is a PKI, storage, or network failure","Verify the pki app / remote management CA configured for identity is reachable and its storage is writable","Temporarily remove or disable the remote admin config block to confirm the rest of the config starts, then re-add it","Inspect Caddy logs for the identity management step immediately above this error for the root cause"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := caddy.Run(cfg); err != nil {\n    if strings.Contains(err.Error(), \"provisioning remote admin endpoint\") {\n        // inspect errors.Unwrap chain; identity/CA or storage problem\n        log.Printf(\"admin identity failure: %v\", errors.Unwrap(err))\n    }\n    return err\n}","preventionTips":["Run `caddy validate --config` before deploy when admin.remote is configured","Keep admin identity storage writable and backed up","Verify the remote management CA/PKI app is provisioned before enabling remote admin"],"tags":["admin-endpoint","identity","pki","startup"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}