{"record":{"id":"df7598523ea2ec28","repo":"caddyserver/caddy","slug":"two-policies-with-same-match-criteria-have-conflic-df7598","errorCode":null,"errorMessage":"two policies with same match criteria have conflicting curves: %v vs. %v","messagePattern":"two policies with same match criteria have conflicting curves: (.+?) vs\\. (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"caddyconfig/httpcaddyfile/httptype.go","lineNumber":1272,"sourceCode":"\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting ALPN: %v vs. %v\",\n\t\t\t\t\t\tcps[i].ALPN, cps[j].ALPN)\n\t\t\t\t}\n\t\t\t\tif len(cps[i].CipherSuites) > 0 &&\n\t\t\t\t\tlen(cps[j].CipherSuites) > 0 &&\n\t\t\t\t\t!reflect.DeepEqual(cps[i].CipherSuites, cps[j].CipherSuites) {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting cipher suites: %v vs. %v\",\n\t\t\t\t\t\tcps[i].CipherSuites, cps[j].CipherSuites)\n\t\t\t\t}\n\t\t\t\tif cps[i].ClientAuthentication == nil &&\n\t\t\t\t\tcps[j].ClientAuthentication != nil &&\n\t\t\t\t\t!reflect.DeepEqual(cps[i].ClientAuthentication, cps[j].ClientAuthentication) {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting client auth configuration: %+v vs. %+v\",\n\t\t\t\t\t\tcps[i].ClientAuthentication, cps[j].ClientAuthentication)\n\t\t\t\t}\n\t\t\t\tif len(cps[i].Curves) > 0 &&\n\t\t\t\t\tlen(cps[j].Curves) > 0 &&\n\t\t\t\t\t!reflect.DeepEqual(cps[i].Curves, cps[j].Curves) {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting curves: %v vs. %v\",\n\t\t\t\t\t\tcps[i].Curves, cps[j].Curves)\n\t\t\t\t}\n\t\t\t\tif cps[i].DefaultSNI != \"\" &&\n\t\t\t\t\tcps[j].DefaultSNI != \"\" &&\n\t\t\t\t\tcps[i].DefaultSNI != cps[j].DefaultSNI {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting default SNI: %s vs. %s\",\n\t\t\t\t\t\tcps[i].DefaultSNI, cps[j].DefaultSNI)\n\t\t\t\t}\n\t\t\t\tif cps[i].FallbackSNI != \"\" &&\n\t\t\t\t\tcps[j].FallbackSNI != \"\" &&\n\t\t\t\t\tcps[i].FallbackSNI != cps[j].FallbackSNI {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting fallback SNI: %s vs. %s\",\n\t\t\t\t\t\tcps[i].FallbackSNI, cps[j].FallbackSNI)\n\t\t\t\t}\n\t\t\t\tif cps[i].ProtocolMin != \"\" &&\n\t\t\t\t\tcps[j].ProtocolMin != \"\" &&\n\t\t\t\t\tcps[i].ProtocolMin != cps[j].ProtocolMin {\n\t\t\t\t\treturn nil, fmt.Errorf(\"two policies with same match criteria have conflicting min protocol: %s vs. %s\",","sourceCodeStart":1254,"sourceCodeEnd":1290,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/caddyconfig/httpcaddyfile/httptype.go#L1254-L1290","documentation":"Two TLS connection policies with the same match criteria declare different non-empty elliptic curve lists (`tls { curves ... }`). Caddy cannot merge two distinct curve preferences for connections both policies would govern, so adaptation stops and prints both lists.","triggerScenarios":"Site blocks sharing hostnames where one sets `tls { curves x25519 }` and another sets `tls { curves secp256r1 x25519 }` on the same server, surviving consolidation with identical SNI matchers.","commonSituations":"Tuning curves for old-client compatibility on one copy of a duplicated site block, or applying a curves snippet inconsistently across imports of the same domain.","solutions":["Use the same curves list (or omit curves for secure defaults) in all blocks for those hostnames","Deduplicate the site block","Split genuinely different curve needs across different servers/ports"],"exampleFix":"# before\nexample.com {\n  tls {\n    curves x25519\n  }\n}\nexample.com {\n  tls {\n    curves secp256r1\n  }\n}\n# after\nexample.com {\n  tls {\n    curves x25519 secp256r1\n  }\n}","handlingStrategy":"validation","validationCode":"for h, lists in group_curves_by_host(sites).items():\n    assert len({tuple(l) for l in lists if l}) <= 1, f'conflicting curves for {h}'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit curves to use safe defaults","One tls snippet per hostname, imported everywhere","Adapt-test after any curves tuning"],"tags":["caddy","tls","curves","caddyfile","conflict"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}