{"record":{"id":"f9f3438bb334af6b","repo":"caddyserver/caddy","slug":"provisioning-automation-policy-d-v","errorCode":null,"errorMessage":"provisioning automation policy %d: %v","messagePattern":"provisioning automation policy (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"modules/caddytls/tls.go","lineNumber":317,"sourceCode":"\t\t// if any names specified by the \"automate\" loader do not qualify for a public\n\t\t// certificate, we should initialize a default internal automation policy\n\t\t// (but we don't want to do this unnecessarily, since it may prompt for password!)\n\t\tif certmagic.SubjectQualifiesForPublicCert(n) {\n\t\t\tcontinue\n\t\t}\n\t\tt.Automation.defaultInternalAutomationPolicy = &AutomationPolicy{\n\t\t\tIssuersRaw: []json.RawMessage{json.RawMessage(`{\"module\":\"internal\"}`)},\n\t\t}\n\t\terr = t.Automation.defaultInternalAutomationPolicy.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning default internal automation policy: %v\", err)\n\t\t}\n\t\tbreak\n\t}\n\tfor i, ap := range t.Automation.Policies {\n\t\terr := ap.Provision(t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning automation policy %d: %v\", i, err)\n\t\t}\n\t}\n\n\t// run replacer on ask URL (for environment variables) -- return errors to prevent surprises (#5036)\n\tif t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != \"\" {\n\t\tt.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"preparing 'ask' endpoint: %v\", err)\n\t\t}\n\t\tperm := PermissionByHTTP{\n\t\t\tEndpoint: t.Automation.OnDemand.Ask,\n\t\t}\n\t\tif err := perm.Provision(ctx); err != nil {\n\t\t\treturn fmt.Errorf(\"provisioning 'ask' module: %v\", err)\n\t\t}\n\t\tt.Automation.OnDemand.permission = perm\n\t}\n","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/tls.go#L299-L335","documentation":"Each user-defined policy in tls.automation.policies is provisioned in order; this error wraps the failure of policy at index %d. The wrapped message comes from AutomationPolicy.Provision (automation.go:182) and can be: subject punycode/IDNA conversion failure, storage module load failure, external certificate manager (ManagersRaw) load failure, issuer module load failure, or default issuer provisioning failure.","triggerScenarios":"A subject like 'exa_mple.com' or invalid unicode that fails idna.ToASCII; an issuers entry with a bad module name or invalid fields (e.g. acme issuer with malformed ca URL); a managers entry whose plugin is not compiled in; policy storage module misconfiguration.","commonSituations":"Hand-written policy subjects with underscores or wildcards in the wrong position; typo'd issuer modules; plugin version drift after Caddy upgrades; DN-ish names or non-DNS strings in subjects.","solutions":["The wrapped error names the exact sub-failure; fix that first (it is usually more specific than this message)","The index %d refers to the position in automation.policies — count from 0 to find the offending policy","Validate subjects are legal DNS names (use punycode for unicode, avoid underscores)","Run 'caddy validate' — provisioning errors surface at validation time, before Start"],"exampleFix":"// before\n{\"policies\": [{\"subjects\": [\"exa_mple.com\"], \"issuers\": [{\"module\": \"acme\"}]}]}\n// after\n{\"policies\": [{\"subjects\": [\"example.com\"], \"issuers\": [{\"module\": \"acme\"}]}]}","handlingStrategy":"validation","validationCode":"import \"github.com/miekg/dns\"\n\nfunc validSubject(s string) bool {\n\t_, ok := dns.IsDomainName(s)\n\treturn ok && !strings.Contains(s, \"_\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the policy index in the message to locate the failing entry (0-based)","Prefer 'caddy validate' — provisioning runs during validation and reports errors before Start","Convert unicode domains to punycode and avoid underscores in subjects"],"tags":["caddy","tls","automation-policy","provisioning","config"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}