{"record":{"id":"b6bae6990719a696","repo":"caddyserver/caddy","slug":"provisioning-session-tickets-configuration-v","errorCode":null,"errorMessage":"provisioning session tickets configuration: %v","messagePattern":"provisioning session tickets configuration: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":340,"sourceCode":"\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != \"\" {\n\t\tt.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"preparing 'ask' endpoint: %v\", err)\n\t\t}\n\t\tperm := PermissionByHTTP{\n\t\t\tEndpoint: t.Automation.OnDemand.Ask,\n\t\t}\n\t\tif err := perm.Provision(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning 'ask' module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = perm\n\t}\n\n\t// session ticket ephemeral keys (STEK) service and provider\n\tif t.SessionTickets != nil {\n\t\terr := t.SessionTickets.provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning session tickets configuration: %v\", err)\n\t\t}\n\t}\n\n\t// ECH (Encrypted ClientHello) initialization\n\tif t.EncryptedClientHello != nil {\n\t\touterNames, err := t.EncryptedClientHello.Provision(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning Encrypted ClientHello components: %v\", err)\n\t\t}\n\n\t\t// outer names should have certificates to reduce client brittleness\n\t\tfor _, outerName := range outerNames {\n\t\t\tif outerName == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif !t.HasCertificateForSubject(outerName) {\n\t\t\t\tif t.automateNames == nil {\n\t\t\t\t\tt.automateNames = make(map[string]struct{})","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L322-L358","documentation":"If tls.session_tickets is configured, its provision(ctx) sets up the STEK (session ticket ephemeral key) service, including loading a configurable STEK provider module (tls.stek.modules.*). This error wraps any failure there: unknown/unloadable provider module or invalid provider options.","triggerScenarios":"{\"session_tickets\": {\"provider\": {\"module\": \"...\"}}} referencing an unregistered module name; a custom STEK provider plugin not compiled into the binary; provider options rejected during its Provision.","commonSituations":"Rarely used feature; typically hit when experimenting with custom STEK providers or after removing a plugin from an xcaddy build while the config still references it.","solutions":["Read the wrapped error to see whether the module name or its options failed","Check 'caddy list-modules' for tls.stek.modules.* entries","Remove the session_tickets block to use the default STEK rotation if the custom provider is not needed"],"exampleFix":"// before\n\"session_tickets\": {\"provider\": {\"module\": \"my_custom_stek\"}}\n// after: drop the block for built-in key rotation\n// (or rebuild with the plugin: xcaddy build --with ...)","handlingStrategy":"validation","validationCode":"caddy list-modules | grep 'tls.stek.modules' || echo 'no stek providers available; remove session_tickets block'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit session_tickets unless a custom STEK provider is genuinely required","Verify stek provider modules exist in the binary before referencing them"],"tags":["caddy","tls","session-tickets","stek","module-loading"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}