{"record":{"id":"a82af771848bf4b7","repo":"caddyserver/caddy","slug":"acme-challenge-q-is-not-supported","errorCode":null,"errorMessage":"acme challenge %q is not supported","messagePattern":"acme challenge %q is not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddypki/acmeserver/challenges.go","lineNumber":26,"sourceCode":"\t\"github.com/smallstep/certificates/authority/provisioner\"\n)\n\n// ACMEChallenge is an opaque string that represents supported ACME challenges.\ntype ACMEChallenge string\n\nconst (\n\tHTTP_01     ACMEChallenge = \"http-01\"\n\tDNS_01      ACMEChallenge = \"dns-01\"\n\tTLS_ALPN_01 ACMEChallenge = \"tls-alpn-01\"\n)\n\n// validate checks if the given challenge is supported.\nfunc (c ACMEChallenge) validate() error {\n\tswitch c {\n\tcase HTTP_01, DNS_01, TLS_ALPN_01:\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"acme challenge %q is not supported\", c)\n\t}\n}\n\n// The unmarshaller first marshals the value into a string. Then it\n// trims any space around it and lowercase it for normaliztion. The\n// method does not and should not validate the value within accepted enums.\nfunc (c *ACMEChallenge) UnmarshalJSON(b []byte) error {\n\tvar s string\n\tif err := json.Unmarshal(b, &s); err != nil {\n\t\treturn err\n\t}\n\t*c = ACMEChallenge(strings.ToLower(strings.TrimSpace(s)))\n\treturn nil\n}\n\n// String returns a string representation of the challenge.\nfunc (c ACMEChallenge) String() string {\n\treturn strings.ToLower(string(c))","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddypki/acmeserver/challenges.go#L8-L44","documentation":"Returned by ACMEChallenge.validate() when the configured challenge type is not one of the supported constants: http-01, dns-01, tls-alpn-01. Note UnmarshalJSON deliberately normalizes (trim + lowercase) but does not validate, so this error appears later, at provisioning/validate time, once the normalized string is checked. The %q formatting shows the exact (already-lowercased) value.","triggerScenarios":"Configuring the acme_server handler with `challenges tls-sni-01` (a removed challenge), `challenges HTTP-01` after normalization still mismatches (this one is actually fine — it lowercases to http-01), or a typo like `dns_01`, `http01`, or `tls-alpn`. Any string outside the three constants hits the default branch.","commonSituations":"Carrying over tls-sni-01 from very old ACME configs (it was deprecated for security reasons); underscore vs hyphen confusion (dns_01 vs dns-01); missing hyphen (http01 vs http-01); hand-written JSON with \"challenges\": [\"HTTP_01\"].","solutions":["Use exactly one of: http-01, dns-01, tls-alpn-01 (hyphens, lowercase; surrounding space/case are normalized away)","Remove tls-sni-01 — it is not supported anywhere modern","Run `caddy validate --config Caddyfile` — this error fires at validate time before serving"],"exampleFix":"# before\nacme_server {\n  challenges tls-sni-01\n}\n\n# after\nacme_server {\n  challenges http-01 dns-01\n}","handlingStrategy":"validation","validationCode":"var supportedChallenges = map[string]bool{\"http-01\": true, \"dns-01\": true, \"tls-alpn-01\": true}\nfunc validChallenges(cs []string) error {\n    for _, c := range cs {\n        if !supportedChallenges[strings.ToLower(strings.TrimSpace(c))] {\n            return fmt.Errorf(\"unsupported challenge %q\", c)\n        }\n    }\n    return nil\n}","typeGuard":"func isValidChallenge(c string) bool {\n    switch strings.ToLower(strings.TrimSpace(c)) {\n    case \"http-01\", \"dns-01\", \"tls-alpn-01\":\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Restrict challenge lists to the three canonical lowercase-hyphenated names","Remove tls-sni-01 from any legacy config during upgrades","Validate config in CI before rollout"],"tags":["pki","acme","challenges","validation","config"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}