{"record":{"id":"32579db1f0618d36","repo":"caddyserver/caddy","slug":"server-listening-on-v-is-configured-for-https-and","errorCode":null,"errorMessage":"server listening on %v is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: %s","messagePattern":"server listening on (.+?) is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/httptype.go","lineNumber":1151,"sourceCode":"\t\treturn nil, false\n\t}\n\treturn sni, true\n}\n\nfunc detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock, options map[string]any) error {\n\thttpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort)\n\tif hp, ok := options[\"http_port\"].(int); ok {\n\t\thttpPort = strconv.Itoa(hp)\n\t}\n\thttpsPort := strconv.Itoa(caddyhttp.DefaultHTTPSPort)\n\tif hsp, ok := options[\"https_port\"].(int); ok {\n\t\thttpsPort = strconv.Itoa(hsp)\n\t}\n\n\tvar httpOrHTTPS string\n\tcheckAndSetHTTP := func(addr Address) error {\n\t\tif httpOrHTTPS == \"HTTPS\" {\n\t\t\terrMsg := fmt.Errorf(\"server listening on %v is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: %s\",\n\t\t\t\tsrv.Listen, addr.Original)\n\t\t\tif addr.Scheme == \"\" && addr.Host == \"\" {\n\t\t\t\terrMsg = fmt.Errorf(\"%s (try specifying https:// in the address)\", errMsg)\n\t\t\t}\n\t\t\treturn errMsg\n\t\t}\n\t\tif len(srv.TLSConnPolicies) > 0 {\n\t\t\t// any connection policies created for an HTTP server\n\t\t\t// is a logical conflict, as it would enable HTTPS\n\t\t\treturn fmt.Errorf(\"server listening on %v is HTTP, but attempts to configure TLS connection policies\", srv.Listen)\n\t\t}\n\t\thttpOrHTTPS = \"HTTP\"\n\t\treturn nil\n\t}\n\tcheckAndSetHTTPS := func(addr Address) error {\n\t\tif httpOrHTTPS == \"HTTP\" {\n\t\t\treturn fmt.Errorf(\"server listening on %v is configured for HTTP and cannot natively multiplex HTTP and HTTPS: %s\",\n\t\t\t\tsrv.Listen, addr.Original)","sourceCodeStart":1133,"sourceCodeEnd":1169,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/httptype.go#L1133-L1169","documentation":"The same Caddy server (same listener set) received both HTTP and HTTPS site addresses. Go's net/http cannot multiplex cleartext and TLS on one listener, so the adapter refuses to build a server that mixes `http://` and `https://` addresses on the same socket.","triggerScenarios":"Two site blocks (or one block) whose keys resolve to the same listen port where one key is `http://example.com` (or matches the configured `http_port`) and another is `https://example.com` or has scheme https on the same port — e.g. `http://example.com` and `https://example.com` both defaulting to ports that share a listener, or explicit `http://example.com:443` next to `https://example.com:443`.","commonSituations":"Trying to serve both a redirect target and TLS site on one port, mixing `http://` and bare hostnames that default to HTTPS on the same explicit port, or copying a redirect block that reuses the HTTPS port with an http:// scheme.","solutions":["Give the HTTP site its own port (default :80) and let HTTPS stay on :443","Remove the `http://` scheme from the address if HTTPS was intended on that port","Use distinct `bind` addresses so they do not land in the same server","Enable `auto_https disable_redirects` if you were only trying to suppress the HTTP redirect"],"exampleFix":"# before\nhttp://example.com:443 {\n  respond \"plain\" \n}\nhttps://example.com:443 {\n  respond \"tls\"\n}\n# after\nhttp://example.com:80 {\n  respond \"plain\"\n}\nhttps://example.com {\n  respond \"tls\"\n}","handlingStrategy":"validation","validationCode":"# Before adapting, ensure no listener mixes schemes:\n# group addresses by host:port; fail if both http and https appear\nfor group in group_addresses_by_listener(keys):\n    schemes = {a.scheme or infer(a.port) for a in group}\n    assert not ({'http','https'} <= schemes), f\"mixed protocols on {group}\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never put http:// sites on the HTTPS port or vice versa","Let Caddy pick default ports (omit :80/:443) so schemes stay separated","Use caddy adapt in CI to fail config mixes early"],"tags":["caddy","caddyfile","http","https","listening"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}