{"record":{"id":"dbc26a2e7bef9a57","repo":"caddyserver/caddy","slug":"loading-tls-automation-management-module-s","errorCode":null,"errorMessage":"loading TLS automation management module: %s","messagePattern":"loading TLS automation management module: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/automation.go","lineNumber":230,"sourceCode":"\t// store them on the policy before putting it on the config\n\n\t// load and provision any cert manager modules\n\tif ap.ManagersRaw != nil {\n\t\tap.hadExplicitManagers = true\n\t\tvals, err := tlsApp.ctx.LoadModule(ap, \"ManagersRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading external certificate manager modules: %v\", err)\n\t\t}\n\t\tfor _, getCertVal := range vals.([]any) {\n\t\t\tap.Managers = append(ap.Managers, getCertVal.(certmagic.Manager))\n\t\t}\n\t}\n\n\t// load and provision any explicitly-configured issuer modules\n\tif ap.IssuersRaw != nil {\n\t\tval, err := tlsApp.ctx.LoadModule(ap, \"IssuersRaw\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"loading TLS automation management module: %s\", err)\n\t\t}\n\t\tfor _, issVal := range val.([]any) {\n\t\t\tap.Issuers = append(ap.Issuers, issVal.(certmagic.Issuer))\n\t\t}\n\t}\n\n\tissuers := ap.Issuers\n\tif len(issuers) == 0 && !ap.implicitTailscaleManagersOnly() {\n\t\tvar err error\n\t\tissuers, err = DefaultIssuersProvisioned(tlsApp.ctx)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// build certmagic.Config and attach it to the policy\n\tstorage := ap.storage\n\tif storage == nil {","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/automation.go#L212-L248","documentation":"The automation policy explicitly lists certificate issuers (issuers, e.g. acme, internal, zerossl modules) and LoadModule failed for one of them. The wrapped error identifies which issuer and why — unknown module, invalid issuer options, or the issuer's own Provision failure.","triggerScenarios":"Configuring \"issuers\" in a TLS automation policy with a module name not compiled in, malformed issuer JSON, or an issuer whose Provision rejects its options (e.g. invalid CA URL, missing email for ZeroSSL).","commonSituations":"JSON configs referencing issuer modules after switching to a stock Caddy build lacking a plugin; typos like \"module\": \"acme\" vs \"acmez\"; issuer sub-options renamed between Caddy versions.","solutions":["Read the wrapped error (%s) — it names the failing issuer and cause; correct the issuer configuration.","If the issuer module is missing, rebuild with xcaddy including the plugin, or switch to a built-in issuer (acme, internal, zerossl).","Cross-check the issuer's JSON keys against the docs for your exact Caddy version.","Simplify: reproduce with a minimal policy containing only the failing issuer to isolate the bad option."],"exampleFix":"// before: unknown issuer module\n\"issuers\": [{\"module\": \"my-issuer\", \"key\": \"value\"}]\n\n// after\n\"issuers\": [{\"module\": \"acme\", \"email\": \"you@example.com\"}]","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := policy.Provision(tlsApp); err != nil {\n    if strings.Contains(err.Error(), \"loading TLS automation management module\") {\n        return fmt.Errorf(\"review policy issuers config: %w\", err)\n    }\n}","preventionTips":["Prefer built-in issuer modules (acme, internal, zerossl) unless a plugin is required.","Pin issuer module JSON to documented keys for your Caddy version.","Use `caddy adapt` + `caddy validate` to catch issuer config errors pre-deploy."],"tags":["tls","acme","issuers","module-system","configuration"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}