{"record":{"id":"7fcab27f53714e90","repo":"caddyserver/caddy","slug":"failed-to-provision-ca-s-w","errorCode":null,"errorMessage":"failed to provision CA %s, %w","messagePattern":"failed to provision CA (.+?), %w","errorType":"http","errorClass":"caddy.APIError","httpStatus":500,"severity":"error","filePath":"modules/caddypki/adminapi.go","lineNumber":212,"sourceCode":"\t// provision it, because the user probably aims to\n\t// change their config to enable PKI immediately after\n\t// if they actually requested the local CA ID.\n\tif !ok {\n\t\tif id != DefaultCAID {\n\t\t\treturn nil, caddy.APIError{\n\t\t\t\tHTTPStatus: http.StatusNotFound,\n\t\t\t\tErr:        fmt.Errorf(\"no certificate authority configured with id: %s\", id),\n\t\t\t}\n\t\t}\n\n\t\t// Provision the default CA, which generates and stores a root\n\t\t// certificate in storage, if one doesn't already exist.\n\t\tca = new(CA)\n\t\terr := ca.Provision(a.ctx, id, a.log)\n\t\tif err != nil {\n\t\t\treturn nil, caddy.APIError{\n\t\t\t\tHTTPStatus: http.StatusInternalServerError,\n\t\t\t\tErr:        fmt.Errorf(\"failed to provision CA %s, %w\", id, err),\n\t\t\t}\n\t\t}\n\t}\n\n\treturn ca, nil\n}\n\nfunc rootAndIntermediatePEM(ca *CA) (root, inter []byte, err error) {\n\troot, err = pemEncodeCert(ca.RootCertificate().Raw)\n\tif err != nil {\n\t\treturn root, inter, err\n\t}\n\n\tfor _, interCert := range ca.IntermediateCertificateChain() {\n\t\tpemBytes, err := pemEncodeCert(interCert.Raw)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/adminapi.go#L194-L230","documentation":"A 500 caddy.APIError returned when the default CA (`local`) was requested but not yet configured, so the admin API tries to provision it on demand (ca.Provision) and that fails. Provisioning generates/loads the root and intermediate from storage, so failures are storage errors (cannot write keys/certs), crypto errors, or missing dependencies. The underlying error is wrapped with %w.","triggerScenarios":"GET /pki/ca/local (or /pki/ca/local/certificates) with no pki app configured, where Provision fails: storage backend error writing the root key, permission-denied on the storage directory, or a root cert in storage without a parseable key. The handler constructs ca = new(CA) and calls Provision with the admin context.","commonSituations":"First request to the admin PKI endpoint on a fresh install whose storage dir is root-owned or read-only; custom storage module (e.g. consul/redis) unreachable at that moment; storage resources half-written after a crash; running with an old root key file format.","solutions":["Read the wrapped cause in the response body — it distinguishes storage errors from crypto errors","Fix storage access: permissions on the storage root (chown to the Caddy user), connectivity/credentials for custom storage modules","If provisioning genuinely failed midway, remove the partial CA resources under the storage (pki directories) and retry the request to regenerate","Alternatively configure the pki app explicitly in config so provisioning happens (and fails loudly) at load time with fuller logs"],"exampleFix":"# before: storage dir owned by root, default CA fails to provision\ncurl http://localhost:2019/pki/ca/local   # 500 failed to provision CA local\n\n# after\nsudo chown -R caddy:caddy /var/lib/caddy   # or the storage root in use\ncurl http://localhost:2019/pki/ca/local","handlingStrategy":"try-catch","validationCode":"// Pre-flight storage writability before first use of the default CA:\nfunc storageWritable() error {\n    dir := filepath.Join(caddy.AppDataDir())\n    f, err := os.CreateTemp(dir, \"pki-probe-*\")\n    if err != nil { return fmt.Errorf(\"storage not writable: %w\", err) }\n    f.Close()\n    os.Remove(f.Name())\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// On 500 'failed to provision CA', read the wrapped cause before acting:\nif resp.StatusCode == 500 && strings.Contains(string(body), \"failed to provision\") {\n    // storage/permission issue — fix environment, then retry the same GET\n    return fmt.Errorf(\"default CA provisioning failed: %s; check storage perms\", body)\n}","preventionTips":["Declare the pki app explicitly in production configs so provisioning errors surface at load time with full logs","Ensure the storage root is writable by the Caddy user from first start","Back up the default CA's root key once generated"],"tags":["pki","admin-api","http-500","provisioning","storage"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}