{"record":{"id":"879183d6fa59a640","repo":"caddyserver/caddy","slug":"loading-client-cert-verifiers-v","errorCode":null,"errorMessage":"loading client cert verifiers: %v","messagePattern":"loading client cert verifiers: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":77,"sourceCode":"\t\tfor _, modIface := range mods.(map[string]any) {\n\t\t\tcp[i].matchers = append(cp[i].matchers, modIface.(ConnectionMatcher))\n\t\t}\n\n\t\t// enable HTTP/2 by default\n\t\tif pol.ALPN == nil {\n\t\t\tpol.ALPN = append(pol.ALPN, defaultALPN...)\n\t\t}\n\n\t\t// pre-build standard TLS config so we don't have to at handshake-time\n\t\terr = pol.buildStandardTLSConfig(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"connection policy %d: building standard TLS config: %s\", i, err)\n\t\t}\n\n\t\tif pol.ClientAuthentication != nil && len(pol.ClientAuthentication.VerifiersRaw) > 0 {\n\t\t\tclientCertValidations, err := ctx.LoadModule(pol.ClientAuthentication, \"VerifiersRaw\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"loading client cert verifiers: %v\", err)\n\t\t\t}\n\t\t\tfor _, validator := range clientCertValidations.([]any) {\n\t\t\t\tcp[i].ClientAuthentication.verifiers = append(cp[i].ClientAuthentication.verifiers, validator.(ClientCertificateVerifier))\n\t\t\t}\n\t\t}\n\n\t\tif len(pol.HandshakeContextRaw) > 0 {\n\t\t\tmodIface, err := ctx.LoadModule(pol, \"HandshakeContextRaw\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"loading handshake context module: %v\", err)\n\t\t\t}\n\t\t\tcp[i].handshakeContext = modIface.(HandshakeContext)\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L59-L95","documentation":"Returned by ConnectionPolicies.Provision when ctx.LoadModule fails to load one of the client certificate verifiers configured under ClientAuthentication.VerifiersRaw (modules under tls.client_auth.verifier.*, e.g. verifier and leaf). The wrapped error carries the module name and underlying cause.","triggerScenarios":"A client_auth block with a 'verifier' subdirective naming a module not compiled in, or a verifier whose own provisioning fails (e.g. leaf verifier with an unloadable trust pool). Also a typo in the verifier name in Caddyfile.","commonSituations":"Config written for a Caddy version/plugin set different from the deployed binary; copy-paste of 'verifier leaf' without the accompanying trust_pool config it requires; version upgrade renaming a verifier.","solutions":["Check the wrapped error for the module ID and cause","Run 'caddy list-modules --packages caddytls' and confirm the tls.client_auth.verifier.* module exists","Rebuild with the required plugin or correct the verifier name","Supply the verifier's required subconfig (e.g. trust_pool for leaf)"],"exampleFix":"# before\nclient_auth {\n\tverifier leaf # missing trust_pool\n}\n\n# after\nclient_auth {\n\tverifier leaf\n\ttrust_pool file /etc/caddy/client-cas.pem\n}","handlingStrategy":"try-catch","validationCode":"# Confirm verifier modules are present before deploying config:\ncaddy list-modules | grep tls.client_auth.verifier","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair every 'verifier <name>' with the subconfig that verifier requires (e.g. trust_pool for leaf)","Keep plugin set identical across environments; validate on the target binary","On Caddy upgrades, re-check verifier module names in release notes"],"tags":["caddy","tls","client-auth","modules","configuration"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}