{"record":{"id":"a2dca4ca3dad741d","repo":"caddyserver/caddy","slug":"provisioning-client-ca-v","errorCode":null,"errorMessage":"provisioning client CA: %v","messagePattern":"provisioning client CA: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":383,"sourceCode":"\tif !alpnFound && (cfg.NextProtos == nil || len(cfg.NextProtos) > 0) {\n\t\tcfg.NextProtos = append(cfg.NextProtos, acmez.ACMETLS1Protocol)\n\t}\n\n\t// min and max protocol versions\n\tif (p.ProtocolMin != \"\" && p.ProtocolMax != \"\") && p.ProtocolMin > p.ProtocolMax {\n\t\treturn fmt.Errorf(\"protocol min (%x) cannot be greater than protocol max (%x)\", p.ProtocolMin, p.ProtocolMax)\n\t}\n\tif p.ProtocolMin != \"\" {\n\t\tcfg.MinVersion = SupportedProtocols[p.ProtocolMin]\n\t}\n\tif p.ProtocolMax != \"\" {\n\t\tcfg.MaxVersion = SupportedProtocols[p.ProtocolMax]\n\t}\n\n\t// client authentication\n\tif p.ClientAuthentication != nil {\n\t\tif err := p.ClientAuthentication.provision(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning client CA: %v\", err)\n\t\t}\n\t\tif err := p.ClientAuthentication.ConfigureTLSConfig(cfg); err != nil {\n\t\t\treturn fmt.Errorf(\"configuring TLS client authentication: %v\", err)\n\t\t}\n\n\t\t// Prevent privilege escalation in case multiple vhosts are configured for\n\t\t// this TLS server; we could potentially figure out if that's the case, but\n\t\t// that might be complex to get right every time. Actually, two proper\n\t\t// solutions could leave tickets enabled, but I am not sure how to do them\n\t\t// properly without significant time investment; there may be new Go\n\t\t// APIs that alloaw this (Wrap/UnwrapSession?) but I do not know how to use\n\t\t// them at this time. TODO: one of these is a possible future enhancement:\n\t\t// A) Prevent resumptions across server identities (certificates): binding the ticket to the\n\t\t// certificate we would serve in a full handshake, or even bind a ticket to the exact SNI\n\t\t// it was issued under (though there are proposals for session resumption across hostnames).\n\t\t// B) Prevent resumptions falsely authenticating a client: include the realm in the ticket,\n\t\t// so that it can be validated upon resumption.\n\t\tcfg.SessionTicketsDisabled = true","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L365-L401","documentation":"Returned by buildStandardTLSConfig when ClientAuthentication.provision fails while setting up client certificate verification for a connection policy. The wrapped error comes from provisioning the trust pool / verifier modules — e.g. loading the CA provider module (file, inline, combined) or parsing its inputs.","triggerScenarios":"A client_auth block whose trust_pool provider fails to provision: unreadable CA file path, malformed PEM, failing inline base64, or an unknown provider module. Also a verifier module failing its own Provision.","commonSituations":"CA file mounted at a different path in a container; PEM file containing a private key or wrong block type instead of CA certs; typo in the trust_pool provider name; permissions on the file.","solutions":["Unwrap the inner error: it names the provider and the underlying failure","Verify the CA file path exists and is readable by the caddy process (container volume mounts!)","Confirm the file is a valid chain of CA certificates in PEM","Check the trust_pool module name is one caddy list-modules shows under tls.ca_pool.source"],"exampleFix":"# before (path wrong inside container)\nclient_auth {\n\ttrust_pool file /etc/ssl/client-ca.pem\n}\n\n# after (correct mounted path)\nclient_auth {\n\ttrust_pool file /etc/caddy/client-ca.pem\n}","handlingStrategy":"try-catch","validationCode":"# Pre-flight file checks for trust_pool file paths:\nfor f in /etc/caddy/ca.pem; do\n  [ -s \"$f\" ] && grep -q 'BEGIN CERTIFICATE' \"$f\" || echo \"bad CA file: $f\"\ndone","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mount CA bundles read-only into containers at fixed paths and verify with a startup healthcheck","Keep CA bundles PEM-only, CERTIFICATE blocks only","Validate full config (including client_auth) with 'caddy validate' before each deploy"],"tags":["caddy","tls","client-auth","trust-pool","configuration"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}