{"record":{"id":"6a9ca7634dc2bff9","repo":"caddyserver/caddy","slug":"dropping-connection","errorCode":null,"errorMessage":"dropping connection","messagePattern":"dropping connection","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"modules/caddytls/connpolicy.go","lineNumber":134,"sourceCode":"\t}\n\n\tgetConfigForClient := func(hello *tls.ClientHelloInfo) (*tls.Config, error) {\n\t\t// filter policies by SNI first, if possible, to speed things up\n\t\t// when there may be lots of policies\n\t\tpossiblePolicies := cp\n\t\tif indexedPolicies, ok := indexedBySNI[asciiServerNameForMatch(hello.ServerName)]; ok {\n\t\t\tpossiblePolicies = indexedPolicies\n\t\t}\n\n\tpolicyLoop:\n\t\tfor _, pol := range possiblePolicies {\n\t\t\tfor _, matcher := range pol.matchers {\n\t\t\t\tif !matcher.Match(hello) {\n\t\t\t\t\tcontinue policyLoop\n\t\t\t\t}\n\t\t\t}\n\t\t\tif pol.Drop {\n\t\t\t\treturn nil, fmt.Errorf(\"dropping connection\")\n\t\t\t}\n\t\t\treturn pol.TLSConfig, nil\n\t\t}\n\n\t\treturn nil, fmt.Errorf(\"no server TLS configuration available for ClientHello: %+v\", hello)\n\t}\n\n\ttlsCfg := &tls.Config{\n\t\tMinVersion:         tls.VersionTLS12,\n\t\tGetConfigForClient: getConfigForClient,\n\t}\n\n\t// enable ECH, if configured\n\tif tlsAppIface, err := ctx.AppIfConfigured(\"tls\"); err == nil {\n\t\ttlsApp := tlsAppIface.(*TLS)\n\n\t\tif tlsApp.EncryptedClientHello != nil && len(tlsApp.EncryptedClientHello.configs) > 0 {\n\t\t\t// if no publication was configured, we apply ECH to all server names by default,","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L116-L152","documentation":"Returned by the GetConfigForClient callback during a TLS handshake when the matched connection policy has Drop=true. It is not a malfunction: the operator explicitly configured a matcher + 'default_sni'-style policy whose action is to refuse the connection (e.g. block TLS for unknown SNI values), and Caddy aborts the handshake by returning this error.","triggerScenarios":"A connection policy with \"drop\": true whose matchers (commonly sni) matched the incoming ClientHello. In Caddyfile: an @matcher-matched route using tls policies with drop, e.g. blocking connections whose SNI is not in an allowlist.","commonSituations":"Clients connecting by IP or with an SNI not in the allowlist get a TLS handshake failure; scanners and probes hitting the server; expected behavior after adding a drop policy but the operator forgot which SNIs are allowed.","solutions":["Confirm this is intended: the matching policy was configured with drop","If the client should be served, add its SNI/domain to the policy's match allowlist or a serving policy that matches earlier","Reorder policies so serving policies for known SNIs come before the catch-all drop policy","To distinguish from misconfig, log matched SNI and compare against the policy list"],"exampleFix":"# before\ntls {\n\tpolicies {\n\t\tpolicy {\n\t\t\tmatch {\n\t\t\t\tsni *\n\t\t\t}\n\t\t\tdrop\n\t\t}\n\t}\n}\n\n# after (serve known SNI, drop only unknown)\ntls {\n\tpolicies {\n\t\tpolicy {\n\t\t\tmatch {\n\t\t\t\tsni example.com\n\t\t\t}\n\t\t}\n\t\tpolicy {\n\t\t\tmatch {\n\t\t\t\tsni *\n\t\t\t}\n\t\t\tdrop\n\t\t}\n\t}\n}","handlingStrategy":"validation","validationCode":"# Before enabling a drop policy, enumerate the SNIs that will still be served:\n# compare your sni matchers against a DNS/inventory list of expected hostnames.\ncaddy adapt --config Caddyfile --adapter caddyfile | jq '.. | .sni? // empty'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Order policies so explicit serve rules precede the catch-all drop","Add monitoring: a spike in 'dropping connection' after deploy usually means an allowlist gap","Document the allowlist wherever the drop policy is defined"],"tags":["caddy","tls","connection-policy","intentional","handshake"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}