caddyserver/caddy · error

provisioning remote admin endpoint: %v

Error message

provisioning remote admin endpoint: %v

What it means

Thrown during finishSettingUp after all apps have started: manageIdentity failed. manageIdentity establishes this server's identity credentials (for remote admin over HTTPS), and its failure is wrapped with this message. It deliberately runs after user apps load so cert management does not block user servers.

Source

Thrown at caddy.go:601

// ProvisionContext creates a new context from the configuration and provisions storage
// and app modules.
// The function is intended for testing and advanced use cases only, typically `Run` should be
// use to ensure a fully functional caddy instance.
// EXPERIMENTAL: While this is public the interface and implementation details of this function may change.
func ProvisionContext(newCfg *Config) (Context, error) {
	return provisionContext(newCfg, false)
}

// finishSettingUp should be run after all apps have successfully started.
func finishSettingUp(ctx Context, cfg *Config) error {
	// establish this server's identity (only after apps are loaded
	// so that cert management of this endpoint doesn't prevent user's
	// servers from starting which likely also use HTTP/HTTPS ports;
	// but before remote management which may depend on these creds)
	err := manageIdentity(ctx, cfg)
	if err != nil {
		return fmt.Errorf("provisioning remote admin endpoint: %v", err)
	}

	// replace any remote admin endpoint
	err = replaceRemoteAdminServer(ctx, cfg)
	if err != nil {
		return fmt.Errorf("provisioning remote admin endpoint: %v", err)
	}

	// if dynamic config is requested, set that up and run it
	if cfg != nil && cfg.Admin != nil && cfg.Admin.Config != nil && cfg.Admin.Config.LoadRaw != nil {
		val, err := ctx.LoadModule(cfg.Admin.Config, "LoadRaw")
		if err != nil {
			return fmt.Errorf("loading config loader module: %s", err)
		}

		logger := Log().Named("config_loader").With(
			zap.String("module", val.(Module).CaddyModule().ID.Name()),
			zap.Int("load_delay", int(cfg.Admin.Config.LoadDelay)))

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check the underlying error text after 'provisioning remote admin endpoint:' to see whether it is a PKI, storage, or network failure
2. Verify the pki app / remote management CA configured for identity is reachable and its storage is writable
3. Temporarily remove or disable the remote admin config block to confirm the rest of the config starts, then re-add it
4. Inspect Caddy logs for the identity management step immediately above this error for the root cause

if err := caddy.Run(cfg); err != nil {
    if strings.Contains(err.Error(), "provisioning remote admin endpoint") {
        // inspect errors.Unwrap chain; identity/CA or storage problem
        log.Printf("admin identity failure: %v", errors.Unwrap(err))
    }
    return err
}

When it happens

Trigger: Caddy is configured with a remote admin endpoint (admin remote) and the identity management step fails, e.g. unable to provision or renew the identity certificate/credentials from the configured remote management CA or identity module.

Common situations: A config with a remote admin section whose identity issuer is unreachable, a PKI app that failed to provision the intermediate/root needed for identity certs, or a read-only/corrupt storage directory preventing identity credential persistence.

Related errors

• provisioning CA '%s': %v
• provisioning admin router module %s: %v
• loading identity issuer modules: %s
• cannot enable remote admin without a certificate cache; conf
• no server identity configured

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/2a7e722513b851e5. Report an issue: GitHub.