{"record":{"id":"c7ab7949813f2ee5","repo":"caddyserver/caddy","slug":"getting-server-identity-credentials-v","errorCode":null,"errorMessage":"getting server identity credentials: %v","messagePattern":"getting server identity credentials: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httploader.go","lineNumber":182,"sourceCode":"\t\t}\n\t}\n\n\treturn resp, err\n}\n\nfunc (hl HTTPLoader) makeClient(ctx caddy.Context) (*http.Client, error) {\n\tclient := &http.Client{\n\t\tTimeout: time.Duration(hl.Timeout),\n\t}\n\n\tif hl.TLS != nil {\n\t\tvar tlsConfig *tls.Config\n\n\t\t// client authentication\n\t\tif hl.TLS.UseServerIdentity {\n\t\t\tcerts, err := ctx.IdentityCredentials(ctx.Logger())\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"getting server identity credentials: %v\", err)\n\t\t\t}\n\t\t\t// See https://github.com/securego/gosec/issues/1054#issuecomment-2072235199\n\t\t\t//nolint:gosec\n\t\t\ttlsConfig = &tls.Config{Certificates: certs}\n\t\t} else if hl.TLS.ClientCertificateFile != \"\" && hl.TLS.ClientCertificateKeyFile != \"\" {\n\t\t\tcert, err := tls.LoadX509KeyPair(hl.TLS.ClientCertificateFile, hl.TLS.ClientCertificateKeyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\t//nolint:gosec\n\t\t\ttlsConfig = &tls.Config{Certificates: []tls.Certificate{cert}}\n\t\t}\n\n\t\t// trusted server certs\n\t\tif len(hl.TLS.RootCAPEMFiles) > 0 {\n\t\t\trootPool := x509.NewCertPool()\n\t\t\tfor _, pemFile := range hl.TLS.RootCAPEMFiles {\n\t\t\t\tpemData, err := os.ReadFile(pemFile)","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httploader.go#L164-L200","documentation":"When the http config loader is configured with tls.use_server_identity, makeClient asks the Caddy context for the server's own identity certificate (the local PKI-installed leaf, via IdentityCredentials) to use as the client certificate. Failure to obtain it (local CA not provisioned, identity cert missing or unreadable) is wrapped with this message.","triggerScenarios":"'use_server_identity' set on the http loader while ctx.IdentityCredentials fails — local PKI not yet provisioned on a fresh host, storage directory missing/unreadable, or the identity certificate absent (e.g. non-persistent container volume).","commonSituations":"First run with a custom or read-only XDG_DATA_HOME; containers missing the persisted storage volume so identity certs never exist; permission changes on the data directory after initial provisioning.","solutions":["Verify Caddy's storage/data directory is writable and persistent (same volume across restarts).","Run 'caddy trust' / start Caddy once so the local PKI and identity cert get provisioned.","Check file permissions on the storage directory for the Caddy user.","If mTLS with a custom CA is intended instead, use client_certificate_file/client_certificate_key_file rather than use_server_identity."],"exampleFix":"# before\nhttp https://cfg.internal/config.json {\n  tls {\n    use_server_identity\n  }\n}\n\n# after (mTLS with explicit client cert when identity creds are unavailable)\nhttp https://cfg.internal/config.json {\n  tls {\n    client_certificate_file /etc/caddy/client.crt\n    client_certificate_key_file /etc/caddy/client.key\n    root_ca /etc/caddy/ca.pem\n  }\n}","handlingStrategy":"validation","validationCode":"# confirm the local PKI identity exists and is readable\nls -l \"${XDG_DATA_HOME:-$HOME/.local/share}/caddy/pki/authorities/local\" 2>/dev/null || echo 'no local PKI: run caddy trust / start once'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Persist Caddy's storage directory across restarts/containers.","Run 'caddy trust' once on fresh hosts before enabling use_server_identity.","Prefer explicit client cert files when the local PKI is unavailable."],"tags":["config-loader","tls","pki","client-certificate"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}