{"record":{"id":"d6106960e9f43948","repo":"caddyserver/caddy","slug":"getting-tls-app-v","errorCode":null,"errorMessage":"getting tls app: %v","messagePattern":"getting tls app: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddyhttp/app.go","lineNumber":196,"sourceCode":"\n// CaddyModule returns the Caddy module information.\nfunc (App) CaddyModule() caddy.ModuleInfo {\n\treturn caddy.ModuleInfo{\n\t\tID:  \"http\",\n\t\tNew: func() caddy.Module { return new(App) },\n\t}\n}\n\n// Provision sets up the app.\nfunc (app *App) Provision(ctx caddy.Context) error {\n\t// store some references\n\tapp.logger = ctx.Logger()\n\tapp.ctx = ctx\n\n\t// provision TLS and events apps\n\ttlsAppIface, err := ctx.App(\"tls\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting tls app: %v\", err)\n\t}\n\tapp.tlsApp = tlsAppIface.(*caddytls.TLS)\n\n\teventsAppIface, err := ctx.App(\"events\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"getting events app: %v\", err)\n\t}\n\n\trepl := caddy.NewReplacer()\n\n\t// this provisions the matchers for each route,\n\t// and prepares auto HTTP->HTTPS redirects, and\n\t// is required before we provision each server\n\terr = app.automaticHTTPSPhase1(ctx, repl)\n\tif err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddyhttp/app.go#L178-L214","documentation":"The http app's Provision first loads the tls app via ctx.App(\"tls\"); if the tls app's own provisioning or validation fails (bad certificate config, invalid issuer, bad automation policy), the failure is wrapped as 'getting tls app'. The http app hard-depends on tls, so a broken TLS config breaks HTTP startup.","triggerScenarios":"Any config where the tls app config is invalid: malformed automation policies, bad ACME issuer fields, unreadable certificate files via files loader, etc. — loaded indirectly while the http app provisions.","commonSituations":"TLS directives with wrong paths or PEM parse errors; issuer module typos; on-demand TLS misconfiguration; version changes to caddytls config schema. The error text says 'getting tls app' but the root cause is inside the tls app's config.","solutions":["Ignore the wrapper and read the nested cause after the colon — fix the tls-side problem it names.","Run 'caddy validate' on the full config to surface the tls error directly.","Common fixes: correct cert/key paths, valid issuer module names, well-formed automation policies.","Bisect by removing tls customization (fall back to automatic HTTPS defaults) and re-adding piecewise."],"exampleFix":"// before (caddyfile)\ntls /etc/caddy/cert.pem /etc/caddy/key.pem  # key.pem path wrong\n\n// after\ntls /etc/caddy/cert.pem /etc/caddy/cert.key","handlingStrategy":"try-catch","validationCode":"// pre-flight: confirm cert/key files referenced by the tls app exist and parse\nfor _, pair := range certPairs(cfg) {\n    if err := checkPair(pair.Cert, pair.Key); err != nil {\n        return err // report before caddy load wraps it\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := caddy.Validate(cfg); err != nil {\n    if strings.Contains(err.Error(), \"getting tls app\") {\n        // root cause is the nested tls error — fix tls config, not http\n    }\n    return err\n}","preventionTips":["Read past the wrapper to the nested cause before changing http settings.","Keep certificate files under paths the service user can read.","Use automatic HTTPS defaults until the rest of the config is proven, then add tls customization stepwise."],"tags":["tls","http","provisioning","dependencies"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}