caddyserver/caddy · error

following http redirects is not allowed

Error message

following http redirects is not allowed

What it means

Error "following http redirects is not allowed" thrown in caddyserver/caddy.

Source

Thrown at modules/caddytls/ondemand.go:181

	if resp.StatusCode < 200 || resp.StatusCode > 299 {
		return fmt.Errorf("%s: %w %s - non-2xx status code %d", name, ErrPermissionDenied, askEndpoint, resp.StatusCode)
	}

	return nil
}

// ErrPermissionDenied is an error that should be wrapped or returned when the
// configured permission module does not allow a certificate to be issued,
// to distinguish that from other errors such as connection failure.
var ErrPermissionDenied = errors.New("certificate not allowed by permission module")

// These perpetual values are used for on-demand TLS.
var (
	onDemandAskClient = &http.Client{
		Timeout: 10 * time.Second,
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return fmt.Errorf("following http redirects is not allowed")
		},
	}
)

// Interface guards
var (
	_ OnDemandPermission = (*PermissionByHTTP)(nil)
	_ caddy.Provisioner  = (*PermissionByHTTP)(nil)
)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Point the 'ask' endpoint directly at the final URL; redirects are not followed for safety.

When it happens

Trigger: Thrown at modules/caddytls/ondemand.go:181 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/b3b41b6a86078ffd. Report an issue: GitHub.