caddyserver/caddy · error

loading client cert verifiers: %v

Error message

loading client cert verifiers: %v

What it means

Returned by ConnectionPolicies.Provision when ctx.LoadModule fails to load one of the client certificate verifiers configured under ClientAuthentication.VerifiersRaw (modules under tls.client_auth.verifier.*, e.g. verifier and leaf). The wrapped error carries the module name and underlying cause.

Source

Thrown at modules/caddytls/connpolicy.go:77

		for _, modIface := range mods.(map[string]any) {
			cp[i].matchers = append(cp[i].matchers, modIface.(ConnectionMatcher))
		}

		// enable HTTP/2 by default
		if pol.ALPN == nil {
			pol.ALPN = append(pol.ALPN, defaultALPN...)
		}

		// pre-build standard TLS config so we don't have to at handshake-time
		err = pol.buildStandardTLSConfig(ctx)
		if err != nil {
			return fmt.Errorf("connection policy %d: building standard TLS config: %s", i, err)
		}

		if pol.ClientAuthentication != nil && len(pol.ClientAuthentication.VerifiersRaw) > 0 {
			clientCertValidations, err := ctx.LoadModule(pol.ClientAuthentication, "VerifiersRaw")
			if err != nil {
				return fmt.Errorf("loading client cert verifiers: %v", err)
			}
			for _, validator := range clientCertValidations.([]any) {
				cp[i].ClientAuthentication.verifiers = append(cp[i].ClientAuthentication.verifiers, validator.(ClientCertificateVerifier))
			}
		}

		if len(pol.HandshakeContextRaw) > 0 {
			modIface, err := ctx.LoadModule(pol, "HandshakeContextRaw")
			if err != nil {
				return fmt.Errorf("loading handshake context module: %v", err)
			}
			cp[i].handshakeContext = modIface.(HandshakeContext)
		}
	}

	return nil
}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the wrapped error for the module ID and cause
2. Run 'caddy list-modules --packages caddytls' and confirm the tls.client_auth.verifier.* module exists
3. Rebuild with the required plugin or correct the verifier name
4. Supply the verifier's required subconfig (e.g. trust_pool for leaf)

Example fix

# before
client_auth {
	verifier leaf # missing trust_pool
}

# after
client_auth {
	verifier leaf
	trust_pool file /etc/caddy/client-cas.pem
}

# Confirm verifier modules are present before deploying config:
caddy list-modules | grep tls.client_auth.verifier

When it happens

Trigger: A client_auth block with a 'verifier' subdirective naming a module not compiled in, or a verifier whose own provisioning fails (e.g. leaf verifier with an unloadable trust pool). Also a typo in the verifier name in Caddyfile.

Common situations: Config written for a Caddy version/plugin set different from the deployed binary; copy-paste of 'verifier leaf' without the accompanying trust_pool config it requires; version upgrade renaming a verifier.

Related errors

• loading handshake matchers: %v
• provisioning client CA: %v
• configuring TLS client authentication: %v
• two policies with same match criteria have conflicting clien
• parsing certificate at index %d: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/879183d6fa59a640. Report an issue: GitHub.