{"record":{"id":"68c1ffb249783f86","repo":"caddyserver/caddy","slug":"provisioning-default-issuer-d-t-v","errorCode":null,"errorMessage":"provisioning default issuer %d: %T: %v","messagePattern":"provisioning default issuer (.+?): %T: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/automation.go","lineNumber":498,"sourceCode":"\tissuers := []certmagic.Issuer{new(ACMEIssuer)}\n\tif strings.TrimSpace(userEmail) != \"\" {\n\t\tissuers = append(issuers, &ACMEIssuer{\n\t\t\tCA:    certmagic.ZeroSSLProductionCA,\n\t\t\tEmail: userEmail,\n\t\t})\n\t}\n\treturn issuers\n}\n\n// DefaultIssuersProvisioned returns empty but provisioned default Issuers from\n// DefaultIssuers(). This function is experimental and has no compatibility promises.\nfunc DefaultIssuersProvisioned(ctx caddy.Context) ([]certmagic.Issuer, error) {\n\tissuers := DefaultIssuers(\"\")\n\tfor i, iss := range issuers {\n\t\tif prov, ok := iss.(caddy.Provisioner); ok {\n\t\t\terr := prov.Provision(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"provisioning default issuer %d: %T: %v\", i, iss, err)\n\t\t\t}\n\t\t}\n\t}\n\treturn issuers, nil\n}\n\n// ChallengesConfig configures the ACME challenges.\ntype ChallengesConfig struct {\n\t// HTTP configures the ACME HTTP challenge. This\n\t// challenge is enabled and used automatically\n\t// and by default.\n\tHTTP *HTTPChallengeConfig `json:\"http,omitempty\"`\n\n\t// TLSALPN configures the ACME TLS-ALPN challenge.\n\t// This challenge is enabled and used automatically\n\t// and by default.\n\tTLSALPN *TLSALPNChallengeConfig `json:\"tls-alpn,omitempty\"`\n","sourceCodeStart":480,"sourceCodeEnd":516,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/automation.go#L480-L516","documentation":"DefaultIssuersProvisioned provisions the default issuer chain (default ACME issuer and, when configured, ZeroSSL) returned by DefaultIssuers(). If any of those issuers implement caddy.Provisioner and their Provision returns an error, this wrapper reports the index and Go type of the failing issuer plus the underlying error. It is marked experimental, and is typically invoked for automation policies that specify no issuers of their own.","triggerScenarios":"An automation policy without explicit issuers (falling back to defaults) during Provision/RebuildCertMagic, where the default ACMEIssuer's Provision fails — e.g. invalid CA URL, email placeholder expansion failure, or unsupported configuration inherited from global settings.","commonSituations":"Global ACME settings (acme ca url, email via env placeholder, eab config) that are invalid; upgrading Caddy where DefaultIssuers gained a new provisioning step that rejects old global config; custom builds patching default issuers.","solutions":["Look at the wrapped error and the reported issuer type (%T) to identify which default issuer failed and why, then fix the corresponding global TLS/ACME setting.","Set issuers explicitly on the automation policy so defaults are not used, bypassing the failing default configuration.","Verify environment variables used in global ACME/email placeholders are set.","If using a forked build, confirm patches to default issuers still Provision cleanly."],"exampleFix":"# before: invalid global CA URL breaks default issuer provisioning\n{\n\tacme_ca https://example.invalid/dir\n}\n\n# after: correct CA or explicit per-site issuer\n{\n\tacme_ca https://acme-v02.api.letsencrypt.org/directory\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"issuers, err := caddytls.DefaultIssuersProvisioned(ctx)\nif err != nil {\n    return nil, fmt.Errorf(\"default issuers unusable; set explicit issuers on the policy: %w\", err)\n}","preventionTips":["Keep global ACME settings (ca url, email) simple and validated.","Pin explicit issuers on critical policies so default-issuer changes cannot break them.","Test provisioning of default issuers in CI against your global config."],"tags":["tls","acme","defaults","provisioning"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}