{"record":{"id":"cfe860a88a2d4737","repo":"caddyserver/caddy","slug":"automate-managing-v-v","errorCode":null,"errorMessage":"automate: managing %v: %v","messagePattern":"automate: managing (.+?): (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"modules/caddytls/tls.go","lineNumber":418,"sourceCode":"// Start activates the TLS module.\nfunc (t *TLS) Start() error {\n\t// warn if on-demand TLS is enabled but no restrictions are in place\n\tif t.Automation.OnDemand == nil || (t.Automation.OnDemand.Ask == \"\" && t.Automation.OnDemand.permission == nil) {\n\t\tfor _, ap := range t.Automation.Policies {\n\t\t\tif ap.OnDemand && ap.isWildcardOrDefault() {\n\t\t\t\tif c := t.logger.Check(zapcore.WarnLevel, \"YOUR SERVER MAY BE VULNERABLE TO ABUSE: on-demand TLS is enabled, but no protections are in place\"); c != nil {\n\t\t\t\t\tc.Write(zap.String(\"docs\", \"https://caddyserver.com/docs/automatic-https#on-demand-tls\"))\n\t\t\t\t}\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\n\t// now that we are running, and all manual certificates have\n\t// been loaded, time to load the automated/managed certificates\n\terr := t.Manage(t.automateNames)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"automate: managing %v: %v\", t.automateNames, err)\n\t}\n\n\tif t.EncryptedClientHello != nil {\n\t\techLogger := t.logger.Named(\"ech\")\n\n\t\t// publish ECH configs in the background; does not need to block\n\t\t// server startup, as it could take a while; then keep keys rotated\n\t\tgo func() {\n\t\t\t// publish immediately first\n\t\t\tif err := t.publishECHConfigs(echLogger); err != nil {\n\t\t\t\techLogger.Error(\"publication(s) failed\", zap.Error(err))\n\t\t\t}\n\n\t\t\t// then every so often, rotate and publish if needed\n\t\t\t// (both of these functions only do something if needed)\n\t\t\tfor {\n\t\t\t\tselect {\n\t\t\t\tcase <-time.After(1 * time.Hour):","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L400-L436","documentation":"On TLS app Start(), all names registered via the 'automate' certificate loader (t.automateNames) are submitted to t.Manage for certificate issuance/renewal. If managing any of them fails — ACME challenges fail, issuers error, storage fails — Start aborts with this error, printing the whole automate name set.","triggerScenarios":"automate: [\"example.com\"] where port 80/443 are unreachable so HTTP/TLS-ALPN challenges fail; no ACME account email; DNS challenge provider misconfigured; firewall blocking Let's Encrypt validation; internal names without a qualifying policy. The wrapped error from certmagic contains per-name detail.","commonSituations":"First-run issuance on firewalled or NAT'd servers; rate limits from repeated test issuance; DNS not yet pointing at the server; clock skew breaking ACME; storage permission errors.","solutions":["Read the wrapped per-name error — it distinguishes challenge failure, rate limit, storage, and DNS issues","Ensure ports 80/443 are publicly reachable, or configure the dns challenge with a working dns provider","Set an ACME email and use the Let's Encrypt staging CA ('acme_ca') while debugging to avoid rate limits","For local/internal names, attach an explicit policy with the internal issuer instead of relying on automate defaults"],"exampleFix":"# before: public ACME for an internal-only name\n{\"certificates\": {\"automate\": [\"myservice.lan\"]}}\n# after\n{\"automation\": {\"policies\": [{\"subjects\": [\"myservice.lan\"], \"issuers\": [{\"module\": \"internal\"}]}]}}","handlingStrategy":"retry","validationCode":"# pre-flight: can a public CA reach us?\nnc -z -w3 yourhost 80 && nc -z -w3 yourhost 443 || echo 'challenge ports unreachable'\ndig +short yourhost A | grep -q . || echo 'no DNS record'","typeGuard":null,"tryCatchPattern":"err := caddy.Start(cfg)\nif err != nil && strings.Contains(err.Error(), \"automate: managing\") {\n\tlog.Printf(\"cert management failed: %v\", err)\n\t// server did not start; fix reachability/credentials and retry after backoff\n}","preventionTips":["Ensure ports 80/443 are open and DNS points at the server before first start","Use the staging ACME CA while testing bulk issuance","Prefer explicit internal-issuer policies for non-public names"],"tags":["caddy","tls","acme","certificate-management","startup"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}