{"record":{"id":"4cd687c3dd4e1f53","repo":"caddyserver/caddy","slug":"secure-request-failed-v","errorCode":null,"errorMessage":"secure request failed: %v","messagePattern":"secure request failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/packagesfuncs.go","lineNumber":288,"sourceCode":"\treturn cmd.Run()\n}\n\nfunc showVersion(path string) error {\n\tcmd := exec.Command(path, \"version\")\n\tcmd.Stdout = os.Stdout\n\tcmd.Stderr = os.Stderr\n\treturn cmd.Run()\n}\n\nfunc downloadBuild(qs url.Values) (*http.Response, error) {\n\tl := caddy.Log()\n\tl.Info(\"requesting build\",\n\t\tzap.String(\"os\", qs.Get(\"os\")),\n\t\tzap.String(\"arch\", qs.Get(\"arch\")),\n\t\tzap.Strings(\"packages\", qs[\"p\"]))\n\tresp, err := http.Get(fmt.Sprintf(\"%s?%s\", downloadPath, qs.Encode()))\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"secure request failed: %v\", err)\n\t}\n\tif resp.StatusCode >= 400 {\n\t\tvar details struct {\n\t\t\tStatusCode int `json:\"status_code\"`\n\t\t\tError      struct {\n\t\t\t\tMessage string `json:\"message\"`\n\t\t\t\tID      string `json:\"id\"`\n\t\t\t} `json:\"error\"`\n\t\t}\n\t\terr2 := json.NewDecoder(resp.Body).Decode(&details)\n\t\tif err2 != nil {\n\t\t\treturn nil, fmt.Errorf(\"download and error decoding failed: HTTP %d: %v\", resp.StatusCode, err2)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"download failed: HTTP %d: %s (id=%s)\", resp.StatusCode, details.Error.Message, details.Error.ID)\n\t}\n\treturn resp, nil\n}\n","sourceCodeStart":270,"sourceCodeEnd":306,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/cmd/packagesfuncs.go#L270-L306","documentation":"downloadBuild() performs a plain http.Get against https://caddyserver.com/api/download; this error wraps any transport-level failure before a response is received. It means the HTTPS request itself failed — DNS resolution, TCP connection, TLS handshake, or a client timeout — not an HTTP error status.","triggerScenarios":"No internet or egress blocked; DNS failure resolving caddyserver.com; corporate proxy not honored (the code uses http.Get, so only HTTP(S)_PROXY env vars apply); TLS interception with an untrusted CA; firewall dropping 443.","commonSituations":"Running 'caddy upgrade' on an air-gapped or proxied server without HTTPS_PROXY set; captive portal; broken resolv.conf in a container; MITM proxy whose CA is not in the system trust store.","solutions":["Check basic connectivity: curl -v 'https://caddyserver.com/api/download?os=linux&arch=amd64'","Set proxy env vars if behind a corporate proxy: export HTTPS_PROXY=http://proxy:8080 before running caddy","Fix DNS (verify /etc/resolv.conf, try a public resolver) or firewall rules allowing 443 to caddyserver.com","If TLS interception is in play, add the proxy CA to the system trust store (or use a standard release binary downloaded out-of-band)"],"exampleFix":"# before\ncaddy upgrade\n# error: download failed: secure request failed: dial tcp: lookup caddyserver.com: no such host\n\n# after\nexport HTTPS_PROXY=http://corporate-proxy:8080\ncaddy upgrade","handlingStrategy":"retry","validationCode":"curl -fsS --max-time 15 'https://caddyserver.com/api/download?os=linux&arch=amd64' -o /dev/null || echo 'download API unreachable; check network/proxy/DNS'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-flight the endpoint with curl before scripting 'caddy upgrade'","Export HTTPS_PROXY in proxied environments (http.Get honors env proxies)","Keep system CA roots current for TLS interception setups"],"tags":["network","proxy","dns","upgrade"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}