{"record":{"id":"7caa836a2f98323b","repo":"caddyserver/caddy","slug":"caching-unmanaged-certificate-v","errorCode":null,"errorMessage":"caching unmanaged certificate: %v","messagePattern":"caching unmanaged certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":271,"sourceCode":"\tmagic := certmagic.New(certCache, certmagic.Config{\n\t\tStorage: ctx.Storage(),\n\t\tLogger:  t.logger,\n\t\tOnEvent: t.onEvent,\n\t\tOCSP: certmagic.OCSPConfig{\n\t\t\tDisableStapling: t.DisableOCSPStapling,\n\t\t},\n\t\tDisableStorageCheck: t.DisableStorageCheck,\n\t})\n\tcertCacheMu.RUnlock()\n\tfor _, loader := range t.certificateLoaders {\n\t\tcerts, err := loader.LoadCertificates()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading certificates: %v\", err)\n\t\t}\n\t\tfor _, cert := range certs {\n\t\t\thash, err := magic.CacheUnmanagedTLSCertificate(ctx, cert.Certificate, cert.Tags)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"caching unmanaged certificate: %v\", err)\n\t\t\t}\n\t\t\tt.loaded[hash] = \"\"\n\t\t}\n\t}\n\n\t// on-demand permission module\n\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.PermissionRaw != nil {\n\t\tif t.Automation.OnDemand.Ask != \"\" {\n\t\t\treturn fmt.Errorf(\"on-demand TLS config conflict: both 'ask' endpoint and a 'permission' module are specified; 'ask' is deprecated, so use only the permission module\")\n\t\t}\n\t\tval, err := ctx.LoadModule(t.Automation.OnDemand, \"PermissionRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading on-demand TLS permission module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = val.(OnDemandPermission)\n\t}\n\n\t// automation/management policies","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L253-L289","documentation":"Each certificate returned by a loader is put into the shared certmagic cache via magic.CacheUnmanagedTLSCertificate. This error means certmagic rejected the parsed certificate: commonly the leaf certificate is not valid for any names, is expired in a way certmagic rejects, has no names extractable from SANs/CN, or the TLS handshake configuration it builds (key type) is unsupported.","triggerScenarios":"Loading a cert whose SAN list is empty; a certificate parsed but whose tags/names cannot be determined; an unsupported private key algorithm (e.g. Ed448 or an encrypted PKCS#8 key that cannot be loaded); corrupted DER inside an otherwise valid PEM envelope.","commonSituations":"Self-generated certs created with unusual OpenSSL options; certs from HSMs or cloud services exported in non-standard ways; mixing up certificate and key file order in load_files entries.","solutions":["Inspect the wrapped error from certmagic; it distinguishes parse vs. handshake-configuration failures","Inspect the cert: 'openssl x509 -in cert.pem -noout -text' — confirm SAN entries exist and cover intended names","Re-encode the key/cert to standard RSA-2048/ECDSA PEM if produced by exotic tooling","Confirm the key file passed alongside actually corresponds to the certificate"],"exampleFix":"# before: cert with no SAN, only CN (rejected)\n$ openssl req -x509 -newkey rsa:2048 -nodes -keyout k.pem -out c.pem -subj \"/CN=example.com\"\n# after: include SAN\n$ openssl req -x509 -newkey rsa:2048 -nodes -keyout k.pem -out c.pem -subj \"/CN=example.com\" -addext \"subjectAltName=DNS:example.com\"","handlingStrategy":"validation","validationCode":"openssl x509 -in cert.pem -noout -ext subjectAltName  # must list DNS names\nopenssl verify -CAfile cert.pem cert.pem","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always generate certs with explicit SANs; CN-only certs are rejected","Verify cert/key pairing (matching modulus) before deploying"],"tags":["caddy","tls","certificate-cache","certmagic","pem"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}