{"record":{"id":"dba0bce22f57c78d","repo":"caddyserver/caddy","slug":"upstream-address-has-conflicting-scheme-https","errorCode":null,"errorMessage":"upstream address has conflicting scheme (https://) and port (:80, the HTTP port)","messagePattern":"upstream address has conflicting scheme \\(https://\\) and port \\(:80, the HTTP port\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddyhttp/reverseproxy/addresses.go","lineNumber":115,"sourceCode":"\t\t\t}\n\t\t}\n\t\tif port == \"\" {\n\t\t\tport = toURL.Port()\n\t\t}\n\n\t\t// there is currently no way to perform a URL rewrite between choosing\n\t\t// a backend and proxying to it, so we cannot allow extra components\n\t\t// in backend URLs\n\t\tif toURL.Path != \"\" || toURL.RawQuery != \"\" || toURL.Fragment != \"\" {\n\t\t\treturn parsedAddr{}, fmt.Errorf(\"for now, URLs for proxy upstreams only support scheme, host, and port components\")\n\t\t}\n\n\t\t// ensure the port and scheme aren't in conflict\n\t\tif toURL.Scheme == \"http\" && port == \"443\" {\n\t\t\treturn parsedAddr{}, fmt.Errorf(\"upstream address has conflicting scheme (http://) and port (:443, the HTTPS port)\")\n\t\t}\n\t\tif toURL.Scheme == \"https\" && port == \"80\" {\n\t\t\treturn parsedAddr{}, fmt.Errorf(\"upstream address has conflicting scheme (https://) and port (:80, the HTTP port)\")\n\t\t}\n\t\tif toURL.Scheme == \"h2c\" && port == \"443\" {\n\t\t\treturn parsedAddr{}, fmt.Errorf(\"upstream address has conflicting scheme (h2c://) and port (:443, the HTTPS port)\")\n\t\t}\n\n\t\t// if port is missing, attempt to infer from scheme\n\t\tif port == \"\" {\n\t\t\tswitch toURL.Scheme {\n\t\t\tcase \"\", \"http\", \"h2c\":\n\t\t\t\tport = \"80\"\n\t\t\tcase \"https\":\n\t\t\t\tport = \"443\"\n\t\t\t}\n\t\t}\n\n\t\tscheme, host = toURL.Scheme, toURL.Hostname()\n\t} else {\n\t\tvar err error","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddyhttp/reverseproxy/addresses.go#L97-L133","documentation":"The upstream declares scheme https:// but an explicit port 80 (the plaintext HTTP default). This is the mirror of the http://:443 conflict: Caddy would be asked to speak TLS to a plaintext port and fails fast at config load.","triggerScenarios":"'reverse_proxy https://backend:80' or 'caddy reverse-proxy --to https://host:80'.","commonSituations":"Backend behind a TLS-terminating load balancer that listens on 80 while the config kept https://; mixing up internal (plaintext) and external (TLS) ports.","solutions":["Use 'http://backend:80' (or just 'backend:80') when the backend is plaintext.","Point the https:// upstream at the actual TLS port (443 or custom).","If TLS terminates upstream of the backend, terminate it in Caddy instead and proxy plaintext."],"exampleFix":"# before\nreverse_proxy https://backend:80\n\n# after\nreverse_proxy http://backend:80","handlingStrategy":"validation","validationCode":"func httpsOnHttpPort(u *url.URL) bool {\n    return u.Scheme == \"https\" && u.Port() == \"80\"\n}\n\nif parsed, err := url.Parse(upstream); err == nil && httpsOnHttpPort(parsed) {\n    return fmt.Errorf(\"upstream %q pairs https:// with the plaintext port 80\", upstream)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use http:// (or bare host:port) for plaintext backends on 80.","Document which upstream ports are TLS vs plaintext per service.","Validate with 'caddy validate' after changing backend ports."],"tags":["reverse-proxy","upstream","tls","port-conflict"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}