{"record":{"id":"4444f1df5174358f","repo":"caddyserver/caddy","slug":"provisioning-encrypted-clienthello-components-v","errorCode":null,"errorMessage":"provisioning Encrypted ClientHello components: %v","messagePattern":"provisioning Encrypted ClientHello components: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":348,"sourceCode":"\t\tif err := perm.Provision(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning 'ask' module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = perm\n\t}\n\n\t// session ticket ephemeral keys (STEK) service and provider\n\tif t.SessionTickets != nil {\n\t\terr := t.SessionTickets.provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning session tickets configuration: %v\", err)\n\t\t}\n\t}\n\n\t// ECH (Encrypted ClientHello) initialization\n\tif t.EncryptedClientHello != nil {\n\t\touterNames, err := t.EncryptedClientHello.Provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning Encrypted ClientHello components: %v\", err)\n\t\t}\n\n\t\t// outer names should have certificates to reduce client brittleness\n\t\tfor _, outerName := range outerNames {\n\t\t\tif outerName == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif !t.HasCertificateForSubject(outerName) {\n\t\t\t\tif t.automateNames == nil {\n\t\t\t\t\tt.automateNames = make(map[string]struct{})\n\t\t\t\t}\n\t\t\t\tt.automateNames[outerName] = struct{}{}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L330-L366","documentation":"When tls.encrypted_client_hello is configured, its Provision loads the ECH key sources and computes the outer names to be used in ECHConfig advertisements. This error wraps any failure in that setup: unparseable ECH keys (ECHConfigList PEM), missing/unloadable DNS provider required to publish ECH configs, or invalid ECH parameters.","triggerScenarios":"Configuring encrypted_client_hello with a keys PEM that is not a valid ECHConfigList; specifying a DNS provider for ECH publication that fails to load; building keys with incompatible draft versions than the runtime expects.","commonSituations":"Early adopters of ECH generating keys with mismatched OpenSSL/Cloudflare tooling; forgetting the dns provider needed for DNS-HTTPS-record publication; draft version drift between Caddy releases.","solutions":["Read the wrapped error — it names whether keys parsing or DNS provider loading failed","Regenerate the ECH key set with a tool/version matching your Caddy build (ECH draft versions must align)","If advertising via DNS, ensure a working tls.dns provider is configured","Test with 'caddy validate' and consult the ECH docs section for current key generation commands"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"openssl pkeyutl ... # or simply:\ntest -s ech_keys.pem && grep -q 'BEGIN ECHCONFIG' ech_keys.pem || echo 'invalid ECH key file'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate ECH keys with tooling matching your Caddy version's ECH draft","Ensure a working DNS provider is configured when ECH configs must be published"],"tags":["caddy","tls","ech","encrypted-clienthello","dns"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}