caddyserver/caddy · error

not a valid big integer: %s

Error message

not a valid big integer: %s

What it means

Returned by bigInt.UnmarshalJSON when a serial_number value in a cert_selection policy is not parseable as a base-10 big integer. bigInt exists because certificate serial numbers exceed int64, so JSON values must be decimal strings; SetString(s, 10) failing means the string contains non-decimal characters (hex prefixes like 0x, colons, whitespace, or a JSON number that is a float).

Source

Thrown at modules/caddytls/certselection.go:207

// bigInt is a big.Int type that interops with JSON encodings as a string.
type bigInt struct{ big.Int }

func (bi bigInt) MarshalJSON() ([]byte, error) {
	return json.Marshal(bi.String())
}

func (bi *bigInt) UnmarshalJSON(p []byte) error {
	if string(p) == "null" {
		return nil
	}
	var stringRep string
	err := json.Unmarshal(p, &stringRep)
	if err != nil {
		return err
	}
	_, ok := bi.SetString(stringRep, 10)
	if !ok {
		return fmt.Errorf("not a valid big integer: %s", p)
	}
	return nil
}

// Interface guard
var _ caddyfile.Unmarshaler = (*CustomCertSelectionPolicy)(nil)

View on GitHub (pinned to 50e54ee279)

Solutions

1. Convert the serial to a plain decimal string: openssl x509 -serial -in cert.pem -noout then strip colons and convert hex to decimal, or use 'python3 -c "print(int('A1B2...', 16))"'
2. Ensure the value is a JSON string of digits only, no 0x prefix, colons, spaces, or sign
3. Validate config with 'caddy validate --config <file>' before deploying to catch this at load time

Example fix

// before
{"serial_number": ["6F:04:25:87"]}

// after (same serial as decimal)
{"serial_number": ["1866016647"]}

// Validate serial strings before putting them in config
func validSerialDecimal(s string) bool {
	if s == "" {
		return false
	}
	_, ok := new(big.Int).SetString(s, 10)
	return ok
}

When it happens

Trigger: Setting "serial_number": "0a:1b:2c..." (colon-separated hex as printed by openssl), "0x1234", "1234.0", or an empty string in a CustomCertSelectionPolicy; also any value where json.Unmarshal into a string fails (e.g. a raw JSON object).

Common situations: Copying the serial from openssl x509 -text output (colon-separated hex) or from a cert viewer showing hex, into JSON config that expects decimal. Mismatch between how the tool displays serials and how Caddy parses them.

Related errors

• recombining SNI matchers: %v
• invalid TLS renegotiation level: %v
• no certificates matched custom selection policy
• unsupported cipher suite: %s
• protocol min (%x) cannot be greater than protocol max (%x)

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/6a38c80539ca4d24. Report an issue: GitHub.