{"record":{"id":"55f1aed9ed30407e","repo":"caddyserver/caddy","slug":"provisioning-default-internal-automation-policy","errorCode":null,"errorMessage":"provisioning default internal automation policy: %v","messagePattern":"provisioning default internal automation policy: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":310,"sourceCode":"\t}\n\tt.Automation.defaultPublicAutomationPolicy = new(AutomationPolicy)\n\terr = t.Automation.defaultPublicAutomationPolicy.Provision(t)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"provisioning default public automation policy: %v\", err)\n\t}\n\tfor n := range t.automateNames {\n\t\t// if any names specified by the \"automate\" loader do not qualify for a public\n\t\t// certificate, we should initialize a default internal automation policy\n\t\t// (but we don't want to do this unnecessarily, since it may prompt for password!)\n\t\tif certmagic.SubjectQualifiesForPublicCert(n) {\n\t\t\tcontinue\n\t\t}\n\t\tt.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{\n\t\t\tIssuersRaw: []json.RawMessage{json.RawMessage(`{\"module\":\"internal\"}`)},\n\t\t}\n\t\terr = t.Automation.defaultInternalAutomationPolicy.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning default internal automation policy: %v\", err)\n\t\t}\n\t\tbreak\n\t}\n\tfor i, ap := range t.Automation.Policies {\n\t\terr := ap.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning automation policy %d: %v\", i, err)\n\t\t}\n\t}\n\n\t// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)\n\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != \"\" {\n\t\tt.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"preparing 'ask' endpoint: %v\", err)\n\t\t}\n\t\tperm := PermissionByHTTP{\n\t\t\tEndpoint: t.Automation.OnDemand.Ask,","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L292-L328","documentation":"If any name in the 'automate' list does not qualify for a public certificate (internal names like .local, IP addresses, unqualified hostnames — see certmagic.SubjectQualifiesForPublicCert), Caddy synthesizes a default internal automation policy with issuer {\"module\":\"internal\"} and provisions it. Failure of that internal issuer provisioning produces this error. Because the policy is hard-coded, failures usually stem from the PKI app or storage, not user config.","triggerScenarios":"automate list contains 'localhost', '127.0.0.1', 'myserver.local', or a bare hostname; the synthesized policy's InternalIssuer Provision then fails — typically when the PKI app or certmagic storage is in a bad state, or in tests where the pki app is absent.","commonSituations":"Dev/test configs managing internal names; configs where the pki app was explicitly emptied; storage errors writing the internal CA intermediate.","solutions":["Read the wrapped error to identify the failing sub-step (issuer loading, storage, certmagic config)","If internal names are unintended, remove them from the automate list","For intentional internal names, make sure the pki app is available/default so the internal issuer can build its CA","Check storage writability (the internal issuer persists CA state)"],"exampleFix":"// before\n{\"certificates\": {\"automate\": [\"myserver.local\"]}}\n// after (explicit policy for internal names, clearer errors)\n{\"automation\": {\"policies\": [{\"subjects\": [\"myserver.local\"], \"issuers\": [{\"module\": \"internal\"}]}]}}","handlingStrategy":"validation","validationCode":"import \"github.com/caddyserver/certmagic\"\n\nfor _, n := range automateNames {\n\tif !certmagic.SubjectQualifiesForPublicCert(n) {\n\t\tlog.Printf(\"%s needs an explicit internal-issuer policy\", n)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Declare explicit automation policies with the internal issuer for non-public names instead of relying on automate","Keep the pki app enabled when internal names are managed"],"tags":["caddy","tls","automation-policy","internal-issuer","pki"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}