{"record":{"id":"9696d3ce9b8480cd","repo":"caddyserver/caddy","slug":"getting-ca-s-v","errorCode":null,"errorMessage":"getting CA %s: %v","messagePattern":"getting CA (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/capools.go","lineNumber":241,"sourceCode":"\treturn caddy.ModuleInfo{\n\t\tID: \"tls.ca_pool.source.pki_root\",\n\t\tNew: func() caddy.Module {\n\t\t\treturn new(PKIRootCAPool)\n\t\t},\n\t}\n}\n\n// Loads the PKI app and load the root certificates into the certificate pool\nfunc (p *PKIRootCAPool) Provision(ctx caddy.Context) error {\n\tpkiApp, err := ctx.AppIfConfigured(\"pki\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"pki_root CA pool requires that a PKI app is configured: %v\", err)\n\t}\n\tpki := pkiApp.(*caddypki.PKI)\n\tfor _, caID := range p.Authority {\n\t\tc, err := pki.GetCA(ctx, caID)\n\t\tif err != nil || c == nil {\n\t\t\treturn fmt.Errorf(\"getting CA %s: %v\", caID, err)\n\t\t}\n\t\tp.ca = append(p.ca, c)\n\t}\n\n\tcaPool := x509.NewCertPool()\n\tvar certs []*x509.Certificate\n\tfor _, ca := range p.ca {\n\t\trootCert := ca.RootCertificate()\n\t\tif rootCert == nil {\n\t\t\treturn fmt.Errorf(\"CA %s has no root certificate\", ca.ID)\n\t\t}\n\t\tcaPool.AddCert(rootCert)\n\t\tcerts = append(certs, rootCert)\n\t}\n\tp.pool = caPool\n\tp.certs = certs\n\n\treturn nil","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/capools.go#L223-L259","documentation":"While provisioning a pki_root CA pool, pki.GetCA(ctx, caID) either returned an error or a nil CA for one of the configured authority IDs. GetCA looks up (and lazily creates) authorities inside the PKI app; failure means the ID could not be resolved to a usable CA in the current configuration.","triggerScenarios":"Listing a `ca <id>` under `trust_pool pki_root` whose ID does not exist and cannot be created in the pki app (e.g. it was declared under a different app instance, has invalid characters, or the pki app was provisioned in a separate config scope).","commonSituations":"Typos in the CA id; referencing a CA defined in a different Caddy instance or config snippet that was not merged; renaming a CA in the pki block without updating the trust pool references.","solutions":["Check the exact `ca` IDs in the trust_pool against the IDs declared in the global `pki` option block and fix any typo.","If using JSON config, confirm apps.pki.cas contains an entry whose key matches the referenced caID.","Run `caddy adapt --config Caddyfile --adapter caddyfile` and inspect the generated pki app to see which CA IDs actually exist."],"exampleFix":"# before\n{\n  pki {\n    ca my_ca { name \"My CA\" }\n  }\n}\nexample.com {\n  tls { client_auth { trust_pool pki_root { ca my-ca } } }\n}\n\n# after\n{\n  pki {\n    ca my_ca { name \"My CA\" }\n  }\n}\nexample.com {\n  tls { client_auth { trust_pool pki_root { ca my_ca } } }\n}","handlingStrategy":"validation","validationCode":"// verify every referenced authority id exists in the adapted JSON pki app\nimport \"encoding/json\"\n\nfunc validateCARIDs(cfgJSON []byte, referenced []string) error {\n\tvar cfg struct {\n\t\tApps struct {\n\t\t\tPKI struct {\n\t\t\t\tCAs map[string]json.RawMessage `json:\"cas\"`\n\t\t\t} `json:\"pki\"`\n\t\t} `json:\"apps\"`\n\t}\n\tif err := json.Unmarshal(cfgJSON, &cfg); err != nil {\n\t\treturn err\n\t}\n\tfor _, id := range referenced {\n\t\tif _, ok := cfg.Apps.PKI.CAs[id]; !ok {\n\t\t\treturn fmt.Errorf(\"CA id %q not defined in pki app\", id)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Define CA IDs once (in the pki global option) and reference them verbatim in trust pools.","Prefer snake_case ids everywhere to avoid dash/underscore mismatches between blocks.","After adapting, diff apps.pki.cas keys against the trust pool authority lists."],"tags":["caddy","caddytls","pki","configuration","id-mismatch"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}