{"record":{"id":"8649878dede42ef1","repo":"caddyserver/caddy","slug":"server-s-setting-up-tls-connection-policies-v","errorCode":null,"errorMessage":"server %s: setting up TLS connection policies: %v","messagePattern":"server (.+?): setting up TLS connection policies: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddyhttp/app.go","lineNumber":398,"sourceCode":"\t\t\terr := srv.Errors.Routes.Provision(ctx)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"server %s: setting up error handling routes: %v\", srvName, err)\n\t\t\t}\n\t\t\tsrv.errorHandlerChain = srv.Errors.Routes.Compile(errorEmptyHandler)\n\t\t}\n\n\t\t// provision the named routes (they get compiled at runtime)\n\t\tfor name, route := range srv.NamedRoutes {\n\t\t\terr := route.Provision(ctx, app.Metrics)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"server %s: setting up named route '%s' handlers: %v\", name, srvName, err)\n\t\t\t}\n\t\t}\n\n\t\t// prepare the TLS connection policies\n\t\terr = srv.TLSConnPolicies.Provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"server %s: setting up TLS connection policies: %v\", srvName, err)\n\t\t}\n\n\t\t// if there is no idle timeout, set a sane default; users have complained\n\t\t// before that aggressive CDNs leave connections open until the server\n\t\t// closes them, so if we don't close them it leads to resource exhaustion\n\t\tif srv.IdleTimeout == 0 {\n\t\t\tsrv.IdleTimeout = defaultIdleTimeout\n\t\t}\n\t\tif srv.ReadHeaderTimeout == 0 {\n\t\t\tsrv.ReadHeaderTimeout = defaultReadHeaderTimeout // see #6663\n\t\t}\n\t}\n\tctx.Context = oldContext\n\treturn nil\n}\n\n// Validate ensures the app's configuration is valid.\nfunc (app *App) Validate() error {","sourceCodeStart":380,"sourceCodeEnd":416,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddyhttp/app.go#L380-L416","documentation":"srv.TLSConnPolicies.Provision builds the TLS connection policies for the server: it resolves certificate selectors, client-auth settings, cipher suites, protocol versions, and loads the TLS app. Any policy that is malformed or references missing resources fails here, wrapped with the server name.","triggerScenarios":"A connection policy with an invalid cipher_suite or protocol_min/max, a client certificate verifier module that fails to load, a certificate selector referencing a nonexistent cert, or the TLS app not being available for a policy requiring it.","commonSituations":"Hardening TLS by copying cipher lists from other servers that include names Go's crypto/tls does not accept; setting protocol_min above protocol_max; referencing ACME-loaded certs by wrong ID.","solutions":["Read the wrapped error to find which policy option failed","Use cipher/protocol names accepted by crypto/tls (e.g. TLS1.3 only has no configurable ciphers) and min<=max","Verify cert IDs / client auth modules exist in this build; then `caddy validate`"],"exampleFix":"// before\n{\"protocol_min\":\"tls1.3\",\"protocol_max\":\"tls1.2\"}\n// after\n{\"protocol_min\":\"tls1.2\",\"protocol_max\":\"tls1.3\"}","handlingStrategy":"validation","validationCode":"// reject obviously bad policies before load\nfor _, cp := range srvCfg.TLSConnPolicies {\n    if cp.ProtocolMin != \"\" && cp.ProtocolMax != \"\" && cp.ProtocolMin > cp.ProtocolMax {\n        return fmt.Errorf(\"protocol_min > protocol_max\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use tls.SupportedVersionsFrom / crypto/tls constants instead of hand-typed version strings","Do not configure cipher suites for TLS 1.3-only policies (not configurable there)","Validate in CI with the same Caddy version as production"],"tags":["caddy","tls","connection-policies","config"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}