caddyserver/caddy · error

filling in global issuer defaults for issuer %d: %v

Error message

filling in global issuer defaults for issuer %d: %v

What it means

Same fillInGlobalACMEDefaults call as error 150, but on the single base automation policy built from global defaults (newBaseAutomationPolicyFromDefaults). Inspecting fillInGlobalACMEDefaults shows its only failing path is the acme_dns-without-DNS-provider check, so this 'for issuer %d' wrapper in practice wraps exactly that error; the index identifies which global issuer (cert_issuer order) triggered it.

Source

Thrown at caddyconfig/httpcaddyfile/tlsapp.go:949

	ap := new(caddytls.AutomationPolicy)
	if hasKeyType {
		ap.KeyType = keyType.(string)
	}

	if hasIssuers && hasLocalCerts {
		return nil, fmt.Errorf("global options are ambiguous: local_certs is confusing when combined with cert_issuer, because local_certs is also a specific kind of issuer")
	}

	if hasIssuers {
		ap.Issuers = issuers.([]certmagic.Issuer)
	} else if hasLocalCerts {
		ap.Issuers = []certmagic.Issuer{new(caddytls.InternalIssuer)}
	}

	if hasGlobalACMEDefaults {
		for i := range ap.Issuers {
			if err := fillInGlobalACMEDefaults(ap.Issuers[i], options); err != nil {
				return nil, fmt.Errorf("filling in global issuer defaults for issuer %d: %v", i, err)
			}
		}
	}

	if hasOCSPStapling {
		ocspConfig := ocspStapling.(certmagic.OCSPConfig)
		ap.DisableOCSPStapling = ocspConfig.DisableStapling
		ap.OCSPOverrides = ocspConfig.ResponderOverrides
	}

	if hasRenewalWindowRatio {
		ap.RenewalWindowRatio = renewalWindowRatio.(float64)
	}

	return ap, nil
}

// consolidateAutomationPolicies combines automation policies that are the same,

View on GitHub (pinned to 50e54ee279)

Solutions

1. Read the trailing '%v' — it names the real failing default (in practice: acme_dns without provider).
2. Give 'acme_dns' a provider or add the global 'dns' option it can inherit.
3. Validate after every change to global ACME options: 'caddy validate --config Caddyfile --adapter caddyfile'.

Example fix

# before
{
  cert_issuer acme
  acme_dns
}

# after
{
  cert_issuer acme
  acme_dns cloudflare {env.CF_API_TOKEN}
}

caddy validate --config Caddyfile --adapter caddyfile  # surfaces the wrapped fillInGlobalACMEDefaults error

When it happens

Trigger: Global 'cert_issuer acme' (or multiple cert_issuer entries) combined with bare 'acme_dns' (nil provider) and no global 'dns' option — the acme_dns error surfaces wrapped with the issuer index.

Common situations: Global blocks listing several cert_issuers with a malformed acme_dns line; EAB/CA migrations where the acme_dns provider argument was dropped.

Related errors

• filling in global issuer defaults for AP %d, issuer %d: %v
• acme_dns specified without DNS provider config, but no provi
• global options are ambiguous: local_certs is confusing when
• expanding DNS override domain '%s': %v
• loading DNS provider module: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/68046c7110d8cb68. Report an issue: GitHub.