{"record":{"id":"f514b0b47d9124ae","repo":"caddyserver/caddy","slug":"s-w-s-non-2xx-status-code-d","errorCode":null,"errorMessage":"%s: %w %s - non-2xx status code %d","messagePattern":"(.+?): %w (.+?) - non-2xx status code (.+?)","errorType":"console","errorClass":"ErrPermissionDenied","httpStatus":null,"severity":"error","filePath":"modules/caddytls/ondemand.go","lineNumber":165,"sourceCode":"\n\tresp, err := onDemandAskClient.Get(askURLString)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"checking %v to determine if certificate for hostname '%s' should be allowed: %v\",\n\t\t\taskEndpoint, name, err)\n\t}\n\tresp.Body.Close()\n\n\tif c := p.logger.Check(zapcore.DebugLevel, \"response from permission endpoint\"); c != nil {\n\t\tc.Write(\n\t\t\tzap.String(\"remote\", remote),\n\t\t\tzap.String(\"domain\", name),\n\t\t\tzap.String(\"url\", askURLString),\n\t\t\tzap.Int(\"status\", resp.StatusCode),\n\t\t)\n\t}\n\n\tif resp.StatusCode < 200 || resp.StatusCode > 299 {\n\t\treturn fmt.Errorf(\"%s: %w %s - non-2xx status code %d\", name, ErrPermissionDenied, askEndpoint, resp.StatusCode)\n\t}\n\n\treturn nil\n}\n\n// ErrPermissionDenied is an error that should be wrapped or returned when the\n// configured permission module does not allow a certificate to be issued,\n// to distinguish that from other errors such as connection failure.\nvar ErrPermissionDenied = errors.New(\"certificate not allowed by permission module\")\n\n// These perpetual values are used for on-demand TLS.\nvar (\n\tonDemandAskClient = &http.Client{\n\t\tTimeout: 10 * time.Second,\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn fmt.Errorf(\"following http redirects is not allowed\")\n\t\t},\n\t}","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/ondemand.go#L147-L183","documentation":"Error \"%s: %w %s - non-2xx status code %d\" thrown in caddyserver/caddy.","triggerScenarios":"Thrown at modules/caddytls/ondemand.go:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the 'ask' endpoint to return a 2xx status for hostnames that should get certificates."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}