What causes "error reading response body: %v" in caddyserver/caddy?

Retry the handshake/request: transient network errors are the most common cause

error reading response body: %v

Error message

error reading response body: %v

What it means

Returned by HTTPCertGetter.GetCertificate when the response body from the certificate endpoint returned HTTP 200 but io.ReadAll failed mid-transfer. This is a transport-level failure (connection reset, timeout, truncated chunked encoding), not a certificate-format problem.

Source

Thrown at modules/caddytls/certmanagers.go:173

		return nil, err
	}

	resp, err := http.DefaultClient.Do(req) //nolint:gosec // SSRF false positive... request URI comes from config
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode == http.StatusNoContent {
		// endpoint is not managing certs for this handshake
		return nil, nil
	}
	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("got HTTP %d", resp.StatusCode)
	}

	bodyBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("error reading response body: %v", err)
	}

	cert, err := tlsCertFromCertAndKeyPEMBundle(bodyBytes)
	if err != nil {
		return nil, err
	}

	return &cert, nil
}

// UnmarshalCaddyfile deserializes Caddyfile tokens into ts.
//
//	... http <url>
func (hcg *HTTPCertGetter) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
	d.Next() // consume cert manager name

	if !d.NextArg() {
		return d.ArgErr()

View on GitHub (pinned to 50e54ee279)

Solutions

Retry the handshake/request: transient network errors are the most common cause
Check upstream and proxy logs for connection resets or read timeouts at the same timestamp
Raise proxy read timeouts if the bundle is large or generation is slow
If persistent, capture a tcpdump of one request to see where the stream is truncated

Defensive patterns

Strategy: retry

Prevention

Serve the bundle with Content-Length set so truncation is detectable and rare
Keep proxy read timeouts generously above bundle generation time
Monitor upstream connection-reset rates; this error is almost always transport-layer

When it happens

Trigger: The remote cert server closes the connection before sending the full body; a proxy between Caddy and the endpoint times out; keep-alive races or TLS renegotiation on the upstream connection; very large bundles hitting a proxy's response size limit mid-stream.

Common situations: Flaky upstream network, misbehaving load balancer with a short proxy_read_timeout, or the cert service crashing while streaming the response. Note this uses http.DefaultClient, which has no overall timeout, so mid-body failures usually come from connection resets rather than client timeouts.

Related errors

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/e000788abc0e4e5e. Report an issue: GitHub.