{"record":{"id":"b825fb35cdd293f6","repo":"caddyserver/caddy","slug":"connection-policy-d-building-standard-tls-config","errorCode":null,"errorMessage":"connection policy %d: building standard TLS config: %s","messagePattern":"connection policy (.+?): building standard TLS config: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/connpolicy.go","lineNumber":71,"sourceCode":"\tfor i, pol := range cp {\n\t\t// matchers\n\t\tmods, err := ctx.LoadModule(pol, \"MatchersRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading handshake matchers: %v\", err)\n\t\t}\n\t\tfor _, modIface := range mods.(map[string]any) {\n\t\t\tcp[i].matchers = append(cp[i].matchers, modIface.(ConnectionMatcher))\n\t\t}\n\n\t\t// enable HTTP/2 by default\n\t\tif pol.ALPN == nil {\n\t\t\tpol.ALPN = append(pol.ALPN, defaultALPN...)\n\t\t}\n\n\t\t// pre-build standard TLS config so we don't have to at handshake-time\n\t\terr = pol.buildStandardTLSConfig(ctx)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"connection policy %d: building standard TLS config: %s\", i, err)\n\t\t}\n\n\t\tif pol.ClientAuthentication != nil && len(pol.ClientAuthentication.VerifiersRaw) > 0 {\n\t\t\tclientCertValidations, err := ctx.LoadModule(pol.ClientAuthentication, \"VerifiersRaw\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"loading client cert verifiers: %v\", err)\n\t\t\t}\n\t\t\tfor _, validator := range clientCertValidations.([]any) {\n\t\t\t\tcp[i].ClientAuthentication.verifiers = append(cp[i].ClientAuthentication.verifiers, validator.(ClientCertificateVerifier))\n\t\t\t}\n\t\t}\n\n\t\tif len(pol.HandshakeContextRaw) > 0 {\n\t\t\tmodIface, err := ctx.LoadModule(pol, \"HandshakeContextRaw\")\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"loading handshake context module: %v\", err)\n\t\t\t}\n\t\t\tcp[i].handshakeContext = modIface.(HandshakeContext)","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/connpolicy.go#L53-L89","documentation":"Returned by ConnectionPolicies.Provision when ConnectionPolicy.buildStandardTLSConfig fails for connection policy index i. It is a wrapper around every error buildStandardTLSConfig can produce: getting the tls app, unsupported cipher suite names, bad curves, min>max protocol versions, and client-CA provisioning/configuring failures. The index tells you which policy in the ordered list is broken.","triggerScenarios":"The i-th connection policy contains an invalid cipher_suite name, protocol_min > protocol_max, a client auth block with an unloadable trust pool, or runs in a context where the tls app failed to load. Caddyfile routes with tls protocol_versions/ciphers in the wrong order or misspelled.","commonSituations":"Typo in a cipher suite name copied from a hardening guide (e.g. TLS_ names for TLS 1.3 suites, which are not configurable); protocol_min tls1.3 with protocol_max tls1.2; multiple sites where one has a bad TLS block and the index in the message points at it.","solutions":["Unwrap the inner error text: it states the exact sub-failure (cipher suite, protocol range, client CA, etc.)","Map the policy index i to the i-th site/policy in your config and fix that block","Fix the specific cause: correct cipher names, order protocol_min <= protocol_max, repair the trust_pool","Validate with 'caddy validate --config <file>' before reload"],"exampleFix":"# before\nexample.com {\n\ttls {\n\t\tprotocol_version tls1.3 tls1.2\n\t}\n}\n\n# after (min first, max second)\nexample.com {\n\ttls {\n\t\tprotocol_version tls1.2 tls1.3\n\t}\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Unwrap to reach the concrete cause:\nif err := pol.buildStandardTLSConfig(ctx); err != nil {\n\tvar target *tls.UnsupportedError // example; real cause varies\n\tif errors.As(err, &target) { /* handle specifically */ }\n\treturn fmt.Errorf(\"policy failed: %w\", err)\n}","preventionTips":["Validate every TLS block with 'caddy validate' before reload; this entire family is load-time detectable","Use only cipher/protocol names from Caddy's current docs, and keep min<=max","When running many sites, note the policy index in the error maps to config order — keep sites ordered in the file to make indices predictable"],"tags":["caddy","tls","connection-policy","configuration","wrapper-error"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}