{"record":{"id":"53b7f9e70514e057","repo":"caddyserver/caddy","slug":"filling-in-global-issuer-defaults-for-ap-d-issue","errorCode":null,"errorMessage":"filling in global issuer defaults for AP %d, issuer %d: %v","messagePattern":"filling in global issuer defaults for AP (.+?), issuer (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/tlsapp.go","lineNumber":473,"sourceCode":"\t\t\t\t\tap.Issuers = caddytls.DefaultIssuers(emailStr)\n\n\t\t\t\t\t// if a specific endpoint is configured, can't use multiple default issuers\n\t\t\t\t\tif globalACMECA != nil {\n\t\t\t\t\t\tap.Issuers = []certmagic.Issuer{new(caddytls.ACMEIssuer)}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\t// finalize and verify policies; do cleanup\n\tif tlsApp.Automation != nil {\n\t\tfor i, ap := range tlsApp.Automation.Policies {\n\t\t\t// ensure all issuers have global defaults filled in\n\t\t\tfor j, issuer := range ap.Issuers {\n\t\t\t\terr := fillInGlobalACMEDefaults(issuer, options)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, warnings, fmt.Errorf(\"filling in global issuer defaults for AP %d, issuer %d: %v\", i, j, err)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// encode all issuer values we created, so they will be rendered in the output\n\t\t\tif len(ap.Issuers) > 0 && ap.IssuersRaw == nil {\n\t\t\t\tfor _, iss := range ap.Issuers {\n\t\t\t\t\tissuerName := iss.(caddy.Module).CaddyModule().ID.Name()\n\t\t\t\t\tap.IssuersRaw = append(ap.IssuersRaw, caddyconfig.JSONModuleObject(iss, \"module\", issuerName, &warnings))\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\t// consolidate automation policies that are the exact same\n\t\ttlsApp.Automation.Policies = consolidateAutomationPolicies(tlsApp.Automation.Policies)\n\n\t\t// ensure automation policies don't overlap subjects (this should be\n\t\t// an error at provision-time as well, but catch it in the adapt phase\n\t\t// for convenience)","sourceCodeStart":455,"sourceCodeEnd":491,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/tlsapp.go#L455-L491","documentation":"During TLS app finalization, each automation policy's issuers get global ACME defaults filled in (fillInGlobalACMEDefaults: email, acme_ca, acme_ca_root, acme_dns, acme_eab, preferred_chains, ...). Inspecting fillInGlobalACMEDefaults shows its only failing path is the acme_dns-without-provider check, so this wrapper ('for AP %d, issuer %d') almost always wraps exactly that error, with the policy and issuer indexes telling you which entry triggered it.","triggerScenarios":"An ACME-capable issuer in policy i whose DNS challenge has no provider while global 'acme_dns' was specified bare (nil) and no global 'dns' option exists; the indexes identify which policy/issuer combination hit it.","commonSituations":"Setting bare 'acme_dns' globally while per-site tls blocks create their own ACME issuers; migrating from per-site dns challenge config to global options incompletely.","solutions":["Read the trailing '%v' of the message — it carries the underlying fillInGlobalACMEDefaults error (in practice: the acme_dns/DNS-provider error).","Give 'acme_dns' a provider (e.g. 'acme_dns cloudflare {env.CF_API_TOKEN}') or add a global 'dns' provider so bare acme_dns can inherit it.","Scope DNS challenge config to the specific site's tls block instead of globally.","Run 'caddy adapt' / 'caddy validate' to iterate quickly."],"exampleFix":"# before\n{\n  acme_dns\n}\n\n# after\n{\n  acme_dns cloudflare {env.CF_API_TOKEN}\n}","handlingStrategy":"validation","validationCode":"caddy validate --config Caddyfile --adapter caddyfile  # surfaces the wrapped fillInGlobalACMEDefaults error","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep global acme_* options minimal and consistent with the issuers in use.","Read the wrapped error after the colon to find the true cause."],"tags":["caddyfile","tls","acme","dns-challenge","global-options"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}