{"record":{"id":"a7064a3e54dd1c09","repo":"caddyserver/caddy","slug":"no-certificate-authority-configured-with-id-s-a7064a","errorCode":null,"errorMessage":"no certificate authority configured with id: %s","messagePattern":"no certificate authority configured with id: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/pki.go","lineNumber":133,"sourceCode":"\t}\n\n\treturn nil\n}\n\n// Stop stops the PKI app.\nfunc (p *PKI) Stop() error {\n\treturn nil\n}\n\n// GetCA retrieves a CA by ID. If the ID is the default\n// CA ID, and it hasn't been provisioned yet, it will\n// be provisioned.\nfunc (p *PKI) GetCA(ctx caddy.Context, id string) (*CA, error) {\n\tca, ok := p.CAs[id]\n\tif !ok {\n\t\t// for anything other than the default CA ID, error out if it wasn't configured\n\t\tif id != DefaultCAID {\n\t\t\treturn nil, fmt.Errorf(\"no certificate authority configured with id: %s\", id)\n\t\t}\n\n\t\t// for the default CA ID, provision it, because we want it to \"just work\"\n\t\terr := p.ProvisionDefaultCA(ctx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to provision default CA: %s\", err)\n\t\t}\n\t\tca = p.CAs[id]\n\t}\n\n\treturn ca, nil\n}\n\n// Interface guards\nvar (\n\t_ caddy.Provisioner = (*PKI)(nil)\n\t_ caddy.App         = (*PKI)(nil)\n)","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/pki.go#L115-L151","documentation":"Returned by PKI.GetCA (modules/caddypki/pki.go:133) when a caller asks for a CA by an ID that is not configured. Only the default CA ID ('local') gets lazy auto-provisioning; any other unknown ID is rejected immediately.","triggerScenarios":"Referencing a CA id in configuration that does not exist in the pki app - e.g. tls issuance internal { ca my_ca } or an internal issuer referencing 'intermediate_ca' while the pki app defines no CA with that id (typo, different name, or the pki app not configured at all so only 'local' exists).","commonSituations":"Renaming a CA in the pki block but not in the tls/issuer reference (or vice versa); assuming a custom CA id is auto-created; copy-pasting configs between sites where the pki app section was dropped; case-sensitive id mismatches (MyCA vs myca).","solutions":["Make the ids match exactly: define the CA under pki { ca <id> } and reference the identical <id> from internal issuers","If you only need a custom internal CA, add an explicit pki app block declaring it instead of relying on auto-creation (only 'local' is implicit)","Check for typos and case differences between the CA definition and its reference","As a fallback, remove the custom id to use the default 'local' CA"],"exampleFix":"# before: referenced CA was never defined\nexample.com {\n  tls {\n    issuance internal {\n      ca my_intermediate\n    }\n  }\n}\n\n# after: define it with the exact same id\n{\n  pki {\n    ca my_intermediate {\n      name \"My Intermediate CA\"\n    }\n  }\n}\nexample.com {\n  tls {\n    issuance internal {\n      ca my_intermediate\n    }\n  }\n}","handlingStrategy":"validation","validationCode":"// programmatically: check the CA exists before requesting it\ntlsApp := ctx.App(\"tls\")\npkiApp := tlsApp.(*caddytls.TLS) // ... obtain *pki.PKI via ctx.App(\"pki\")\nif _, ok := pkiApp.CAs[\"my_intermediate\"]; !ok {\n    return fmt.Errorf(\"CA 'my_intermediate' must be declared in the pki app before use\")\n}","typeGuard":"// config-level guard: grep that every referenced ca id is defined\n// Caddyfile:\n//   defined:  pki { ca <id> { ... } }\n//   referenced: issuance internal { ca <id> }\n// ensure the sets match exactly (case-sensitive)","tryCatchPattern":"ca, err := p.GetCA(ctx, id)\nif err != nil {\n    if strings.Contains(err.Error(), \"no certificate authority configured\") {\n        // typo or missing pki block: declare the CA or fix the reference\n        return nil, fmt.Errorf(\"check pki app config: %w\", err)\n    }\n    return nil, err\n}","preventionTips":["Keep CA ids in one place (snippets/variables) and reference them everywhere else","Lint configs: extract all `ca <id>` references and all `pki { ca <id> }` definitions and diff the lists","Remember CA ids are case-sensitive and only 'local' is auto-provisioned"],"tags":["pki","configuration","ca-id","internal-issuer"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}