{"record":{"id":"8232d6ed99d527c8","repo":"caddyserver/caddy","slug":"server-listening-on-v-is-http-but-attempts-to-co","errorCode":null,"errorMessage":"server listening on %v is HTTP, but attempts to configure TLS connection policies","messagePattern":"server listening on (.+?) is HTTP, but attempts to configure TLS connection policies","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/httptype.go","lineNumber":1161,"sourceCode":"\thttpsPort := strconv.Itoa(caddyhttp.DefaultHTTPSPort)\n\tif hsp, ok := options[\"https_port\"].(int); ok {\n\t\thttpsPort = strconv.Itoa(hsp)\n\t}\n\n\tvar httpOrHTTPS string\n\tcheckAndSetHTTP := func(addr Address) error {\n\t\tif httpOrHTTPS == \"HTTPS\" {\n\t\t\terrMsg := fmt.Errorf(\"server listening on %v is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: %s\",\n\t\t\t\tsrv.Listen, addr.Original)\n\t\t\tif addr.Scheme == \"\" && addr.Host == \"\" {\n\t\t\t\terrMsg = fmt.Errorf(\"%s (try specifying https:// in the address)\", errMsg)\n\t\t\t}\n\t\t\treturn errMsg\n\t\t}\n\t\tif len(srv.TLSConnPolicies) > 0 {\n\t\t\t// any connection policies created for an HTTP server\n\t\t\t// is a logical conflict, as it would enable HTTPS\n\t\t\treturn fmt.Errorf(\"server listening on %v is HTTP, but attempts to configure TLS connection policies\", srv.Listen)\n\t\t}\n\t\thttpOrHTTPS = \"HTTP\"\n\t\treturn nil\n\t}\n\tcheckAndSetHTTPS := func(addr Address) error {\n\t\tif httpOrHTTPS == \"HTTP\" {\n\t\t\treturn fmt.Errorf(\"server listening on %v is configured for HTTP and cannot natively multiplex HTTP and HTTPS: %s\",\n\t\t\t\tsrv.Listen, addr.Original)\n\t\t}\n\t\thttpOrHTTPS = \"HTTPS\"\n\t\treturn nil\n\t}\n\n\tfor _, sblock := range serverBlocks {\n\t\tfor _, addr := range sblock.parsedKeys {\n\t\t\tif addr.Scheme == \"http\" || addr.Port == httpPort {\n\t\t\t\tif err := checkAndSetHTTP(addr); err != nil {\n\t\t\t\t\treturn err","sourceCodeStart":1143,"sourceCodeEnd":1179,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/httptype.go#L1143-L1179","documentation":"A server classified as HTTP (because at least one of its addresses is http:// or uses http_port) also carries TLS connection policies. Connection policies only make sense where TLS terminates, so applying them to a plaintext server is a logical conflict and adaptation aborts.","triggerScenarios":"A site block with an `http://` address that also defines `tls` settings (e.g. `http://example.com { tls internal }`), or a global TLS policy attached via global options to a server whose blocks are all HTTP, producing non-empty srv.TLSConnPolicies when checkAndSetHTTP runs.","commonSituations":"Leftover `tls` directive after switching a site to `http://` (e.g. behind another TLS-terminating proxy), or a `tls` global policy plus `http_port` sites on the same server.","solutions":["Remove the `tls` directive/policy from the http:// site block","Change the site address to `https://` if TLS should terminate at Caddy","Move the TLS-terminating site to its own port/server"],"exampleFix":"# before\nhttp://example.com {\n  tls internal\n  respond \"hi\"\n}\n# after\nhttp://example.com {\n  respond \"hi\"\n}","handlingStrategy":"validation","validationCode":"# Site blocks with http:// scheme must not contain a tls directive\nfor block in blocks:\n    if block.scheme == 'http' and block.has_directive('tls'):\n        raise ConfigError('tls on plaintext site: ' + block.key)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove tls from sites fronted by an external TLS terminator","Prefer auto_https defaults instead of hand-managed schemes","Lint for `tls` inside `http://` blocks"],"tags":["caddy","caddyfile","tls","http","conflict"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}