caddyserver/caddy · error

provisioning session tickets configuration: %v

Error message

provisioning session tickets configuration: %v

What it means

If tls.session_tickets is configured, its provision(ctx) sets up the STEK (session ticket ephemeral key) service, including loading a configurable STEK provider module (tls.stek.modules.*). This error wraps any failure there: unknown/unloadable provider module or invalid provider options.

Source

Thrown at modules/caddytls/tls.go:340

	if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
		t.Automation.OnDemand.Ask, err = repl.ReplaceOrErr(t.Automation.OnDemand.Ask, true, true)
		if err != nil {
			return fmt.Errorf("preparing 'ask' endpoint: %v", err)
		}
		perm := PermissionByHTTP{
			Endpoint: t.Automation.OnDemand.Ask,
		}
		if err := perm.Provision(ctx); err != nil {
			return fmt.Errorf("provisioning 'ask' module: %v", err)
		}
		t.Automation.OnDemand.permission = perm
	}

	// session ticket ephemeral keys (STEK) service and provider
	if t.SessionTickets != nil {
		err := t.SessionTickets.provision(ctx)
		if err != nil {
			return fmt.Errorf("provisioning session tickets configuration: %v", err)
		}
	}

	// ECH (Encrypted ClientHello) initialization
	if t.EncryptedClientHello != nil {
		outerNames, err := t.EncryptedClientHello.Provision(ctx)
		if err != nil {
			return fmt.Errorf("provisioning Encrypted ClientHello components: %v", err)
		}

		// outer names should have certificates to reduce client brittleness
		for _, outerName := range outerNames {
			if outerName == "" {
				continue
			}
			if !t.HasCertificateForSubject(outerName) {
				if t.automateNames == nil {
					t.automateNames = make(map[string]struct{})

View on GitHub (pinned to 50e54ee279)

Solutions

1. Read the wrapped error to see whether the module name or its options failed
2. Check 'caddy list-modules' for tls.stek.modules.* entries
3. Remove the session_tickets block to use the default STEK rotation if the custom provider is not needed

Example fix

// before
"session_tickets": {"provider": {"module": "my_custom_stek"}}
// after: drop the block for built-in key rotation
// (or rebuild with the plugin: xcaddy build --with ...)

caddy list-modules | grep 'tls.stek.modules' || echo 'no stek providers available; remove session_tickets block'

When it happens

Trigger: {"session_tickets": {"provider": {"module": "..."}}} referencing an unregistered module name; a custom STEK provider plugin not compiled into the binary; provider options rejected during its Provision.

Common situations: Rarely used feature; typically hit when experimenting with custom STEK providers or after removing a plugin from an xcaddy build while the config still references it.

Related errors

• loading overall DNS provider module: %v
• loading certificate loader modules: %s
• loading on-demand TLS permission module: %v
• WebSocket connections aren't allowed.
• Disabling same-origin restrictions is not allowed.

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/b6bae6990719a696. Report an issue: GitHub.