{"record":{"id":"68046c7110d8cb68","repo":"caddyserver/caddy","slug":"filling-in-global-issuer-defaults-for-issuer-d","errorCode":null,"errorMessage":"filling in global issuer defaults for issuer %d: %v","messagePattern":"filling in global issuer defaults for issuer (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/tlsapp.go","lineNumber":949,"sourceCode":"\tap := new(caddytls.AutomationPolicy)\n\tif hasKeyType {\n\t\tap.KeyType = keyType.(string)\n\t}\n\n\tif hasIssuers && hasLocalCerts {\n\t\treturn nil, fmt.Errorf(\"global options are ambiguous: local_certs is confusing when combined with cert_issuer, because local_certs is also a specific kind of issuer\")\n\t}\n\n\tif hasIssuers {\n\t\tap.Issuers = issuers.([]certmagic.Issuer)\n\t} else if hasLocalCerts {\n\t\tap.Issuers = []certmagic.Issuer{new(caddytls.InternalIssuer)}\n\t}\n\n\tif hasGlobalACMEDefaults {\n\t\tfor i := range ap.Issuers {\n\t\t\tif err := fillInGlobalACMEDefaults(ap.Issuers[i], options); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"filling in global issuer defaults for issuer %d: %v\", i, err)\n\t\t\t}\n\t\t}\n\t}\n\n\tif hasOCSPStapling {\n\t\tocspConfig := ocspStapling.(certmagic.OCSPConfig)\n\t\tap.DisableOCSPStapling = ocspConfig.DisableStapling\n\t\tap.OCSPOverrides = ocspConfig.ResponderOverrides\n\t}\n\n\tif hasRenewalWindowRatio {\n\t\tap.RenewalWindowRatio = renewalWindowRatio.(float64)\n\t}\n\n\treturn ap, nil\n}\n\n// consolidateAutomationPolicies combines automation policies that are the same,","sourceCodeStart":931,"sourceCodeEnd":967,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/tlsapp.go#L931-L967","documentation":"Same fillInGlobalACMEDefaults call as error 150, but on the single base automation policy built from global defaults (newBaseAutomationPolicyFromDefaults). Inspecting fillInGlobalACMEDefaults shows its only failing path is the acme_dns-without-DNS-provider check, so this 'for issuer %d' wrapper in practice wraps exactly that error; the index identifies which global issuer (cert_issuer order) triggered it.","triggerScenarios":"Global 'cert_issuer acme' (or multiple cert_issuer entries) combined with bare 'acme_dns' (nil provider) and no global 'dns' option — the acme_dns error surfaces wrapped with the issuer index.","commonSituations":"Global blocks listing several cert_issuers with a malformed acme_dns line; EAB/CA migrations where the acme_dns provider argument was dropped.","solutions":["Read the trailing '%v' — it names the real failing default (in practice: acme_dns without provider).","Give 'acme_dns' a provider or add the global 'dns' option it can inherit.","Validate after every change to global ACME options: 'caddy validate --config Caddyfile --adapter caddyfile'."],"exampleFix":"# before\n{\n  cert_issuer acme\n  acme_dns\n}\n\n# after\n{\n  cert_issuer acme\n  acme_dns cloudflare {env.CF_API_TOKEN}\n}","handlingStrategy":"validation","validationCode":"caddy validate --config Caddyfile --adapter caddyfile  # surfaces the wrapped fillInGlobalACMEDefaults error","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy DNS provider arguments verbatim and verify env var expansion.","Validate after every change to global ACME options."],"tags":["caddyfile","tls","acme","global-options","dns-challenge"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}