caddyserver/caddy · warning

encoding STEK gob: %v

Error message

encoding STEK gob: %v

What it means

storeSTEK gob-encodes the distributedSTEK value before writing it to storage; encode failures are wrapped as 'encoding STEK gob'. Gob encode of this struct essentially cannot fail in practice unless in-memory state is corrupted or contains unsupported types introduced by a code change.

Source

Thrown at modules/caddytls/distributedstek/distributedstek.go:137

func (s *Provider) loadSTEK() (distributedSTEK, error) {
	var sg distributedSTEK
	gobBytes, err := s.storage.Load(s.ctx, stekFileName)
	if err != nil {
		return sg, err // don't wrap, in case error is certmagic.ErrNotExist
	}
	dec := gob.NewDecoder(bytes.NewReader(gobBytes))
	err = dec.Decode(&sg)
	if err != nil {
		return sg, fmt.Errorf("STEK gob corrupted: %v", err)
	}
	return sg, nil
}

func (s *Provider) storeSTEK(dstek distributedSTEK) error {
	var buf bytes.Buffer
	err := gob.NewEncoder(&buf).Encode(dstek)
	if err != nil {
		return fmt.Errorf("encoding STEK gob: %v", err)
	}
	err = s.storage.Store(s.ctx, stekFileName, buf.Bytes())
	if err != nil {
		return fmt.Errorf("storing STEK gob: %v", err)
	}
	return nil
}

// getSTEK locks and loads the current STEK from storage. If none
// currently exists, a new STEK is created and persisted. If the
// current STEK is outdated (NextRotation time is in the past),
// then it is rotated and persisted. The resulting STEK is returned.
func (s *Provider) getSTEK() (distributedSTEK, error) {
	err := s.storage.Lock(s.ctx, stekLockName)
	if err != nil {
		return distributedSTEK{}, fmt.Errorf("failed to acquire storage lock: %v", err)
	}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Treat as a bug: capture logs and the Caddy/xcaddy build list (caddy version, plugins) and report it
2. Rebuild with stock Caddy if running a fork with modified STEK structures
3. Restart the instance to reset in-memory STEK state; if persistent, delete the stored stek object as a last resort

// If orchestrating Caddy programmatically, a transient in-memory encode failure
// is cleared by re-provisioning (reload). Persistent recurrence = bug: collect 'caddy version'
// and plugin list and report upstream.

When it happens

Trigger: Memory corruption or a bug (in Caddy or a plugin modifying STEK state); theoretically an unexported/unsupported field type change in distributedSTEK.

Common situations: Near-never seen in the field; if it appears, suspect a faulty build or a patched fork of Caddy/caddytls.

Related errors

• STEK gob corrupted: %v
• recombining SNI matchers: %v
• getting tls app: %v
• loading TLS storage module: %s
• creating TLS storage configuration: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/8b4d9f46f344b486. Report an issue: GitHub.