caddyserver/caddy · error

forming request: %v

Error message

forming request: %v

What it means

While fetching ZeroSSL EAB credentials, http.NewRequestWithContext failed to build the POST request to https://app.zerossl.com/acme/eab-credentials-email. This step only parses the URL and method, so failure indicates a malformed URL or an invalid context rather than a network problem. In practice it is almost impossible to hit unless the zerossl.BaseURL constant or the request context is bad.

Source

Thrown at modules/caddytls/acmeissuer.go:380

// generateZeroSSLEABCredentials generates ZeroSSL EAB credentials for the primary contact email
// on the issuer. It should only be usedif the CA endpoint is ZeroSSL. An email address is required.
func (iss *ACMEIssuer) generateZeroSSLEABCredentials(ctx context.Context, acct acme.Account) (*acme.EAB, acme.Account, error) {
	if strings.TrimSpace(iss.Email) == "" {
		return nil, acme.Account{}, fmt.Errorf("your email address is required to use ZeroSSL's ACME endpoint")
	}

	if len(acct.Contact) == 0 {
		// we borrow the email from config or the default email, so ensure it's saved with the account
		acct.Contact = []string{"mailto:" + iss.Email}
	}

	endpoint := zerossl.BaseURL + "/acme/eab-credentials-email"
	form := url.Values{"email": []string{iss.Email}}
	body := strings.NewReader(form.Encode())

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, body)
	if err != nil {
		return nil, acct, fmt.Errorf("forming request: %v", err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("User-Agent", certmagic.UserAgent)

	resp, err := http.DefaultClient.Do(req) //nolint:gosec // no SSRF since URL is from trusted config
	if err != nil {
		return nil, acct, fmt.Errorf("performing EAB credentials request: %v", err)
	}
	defer resp.Body.Close()

	var result struct {
		Success bool `json:"success"`
		Error   struct {
			Code int    `json:"code"`
			Type string `json:"type"`
		} `json:"error"`
		EABKID     string `json:"eab_kid"`
		EABHMACKey string `json:"eab_hmac_key"`

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error message: if it mentions 'context canceled', ensure the server is not shutting down mid-issuance and retry issuance.
2. If running a fork or custom build, verify zerossl.BaseURL is a valid absolute URL (scheme + host).
3. Retry the operation; transient shutdown races are the most common real cause.

u, err := url.Parse(zerossl.BaseURL)
if err != nil || !u.IsAbs() {
    return fmt.Errorf("invalid ZeroSSL base URL: %v", err)
}

if err := issuer.Register(ctx); err != nil {
    if strings.Contains(err.Error(), "forming request") {
        // context or URL issue, not network; check shutdown state and retry once
        time.Sleep(time.Second)
        err = issuer.Register(ctx)
    }
}

When it happens

Trigger: A cancelled or malformed context passed into the ACME registration flow, or a build of Caddy/plugins where zerossl.BaseURL was modified/overridden to an unparseable URL.

Common situations: Rare. Typically only seen with forks that override the ZeroSSL base URL, or when the enclosing operation's context is already cancelled before the EAB call.

Related errors

• your email address is required to use ZeroSSL's ACME endpoin
• performing EAB credentials request: %v
• decoding API response: %v
• failed getting EAB credentials: HTTP %d: %s (code %d)
• failed getting EAB credentials: HTTP %d

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/4c018b83cc1be848. Report an issue: GitHub.