{"record":{"id":"820b38290db82764","repo":"caddyserver/caddy","slug":"getting-tls-app-v-820b38","errorCode":null,"errorMessage":"getting tls app: %v","messagePattern":"getting tls app: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":272,"sourceCode":"\t// so it can be minimally adjusted after provisioning\n\t// if necessary (like to adjust NextProtos to disable HTTP/2),\n\t// and may be unexported in the future.\n\tTLSConfig *tls.Config `json:\"-\"`\n}\n\ntype HandshakeContext interface {\n\t// HandshakeContext returns a context to pass into CertMagic's\n\t// GetCertificate function used to serve, load, and manage certs\n\t// during TLS handshakes. Generally you'll start with the context\n\t// from the ClientHelloInfo, but you may use other information\n\t// from it as well. Return an error to abort the handshake.\n\tHandshakeContext(*tls.ClientHelloInfo) (context.Context, error)\n}\n\nfunc (p *ConnectionPolicy) buildStandardTLSConfig(ctx caddy.Context) error {\n\ttlsAppIface, err := ctx.App(\"tls\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting tls app: %v\", err)\n\t}\n\ttlsApp := tlsAppIface.(*TLS)\n\n\t// fill in some \"easy\" default values, but for other values\n\t// (such as slices), we should ensure that they start empty\n\t// so the user-provided config can fill them in; then we will\n\t// fill in a default config at the end if they are still unset\n\tcfg := &tls.Config{\n\t\tNextProtos: p.ALPN,\n\t\tGetCertificate: func(hello *tls.ClientHelloInfo) (*tls.Certificate, error) {\n\t\t\t// TODO: I don't love how this works: we pre-build certmagic configs\n\t\t\t// so that handshakes are faster. Unfortunately, certmagic configs are\n\t\t\t// comprised of settings from both a TLS connection policy and a TLS\n\t\t\t// automation policy. The only two fields (as of March 2020; v2 beta 17)\n\t\t\t// of a certmagic config that come from the TLS connection policy are\n\t\t\t// CertSelection and DefaultServerName, so an automation policy is what\n\t\t\t// builds the base certmagic config. Since the pre-built config is\n\t\t\t// shared, I don't think we can change any of its fields per-handshake,","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L254-L290","documentation":"Returned by ConnectionPolicy.buildStandardTLSConfig when ctx.App(\"tls\") fails to retrieve the running TLS app while a connection policy is being built. Because connection policies are built during the TLS app's own provisioning, this error indicates a fundamental config/context wiring problem (the tls app module itself failed or is not in the config) rather than anything operator-fixable per-policy.","triggerScenarios":"Calling ConnectionPolicies.Provision/TLSConfig outside a properly initialized caddy.Context, or a config where the tls app failed to load earlier and error propagation reached policy building. Almost exclusively seen by embedders and plugin authors invoking these APIs with a hand-made context.","commonSituations":"Unit tests or custom embedders building connection policies with a context lacking the tls app; internal error paths during partial config loads. End users of stock caddy essentially never see it in isolation.","solutions":["Ensure Provision/TLSConfig is called with the caddy.Context from a config that includes a tls app","If embedding, register and provision the tls app before building connection policies","Inspect earlier log lines/errors: the tls app load failure is the root cause and is reported before this wrapper","Simplify the config to isolate which top-level app fails to load"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Embedders: ensure the tls app is loaded before building policies\n_, err := ctx.App(\"tls\")\nif err != nil {\n\treturn fmt.Errorf(\"tls app unavailable, cannot build policies: %w\", err)\n}","preventionTips":["Only call ConnectionPolicies.Provision/TLSConfig with a context from a fully loaded config containing the tls app","In tests, use caddy's test helpers that run a real config rather than a bare context","Investigate earlier errors first — this wrapper is downstream of tls app load failure"],"tags":["caddy","tls","embedding","internal","context"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}