caddyserver/caddy · error

%s (try specifying https:// in the address)

Error message

%s (try specifying https:// in the address)

What it means

An appended hint to error 122: when the offending mixed-protocol address has neither scheme nor host (e.g. a bare `:443` address), the adapter suggests specifying `https://` explicitly so the address is unambiguously HTTPS rather than relying on port-based inference.

Source

Thrown at caddyconfig/httpcaddyfile/httptype.go:1154

}

func detectConflictingSchemes(srv *caddyhttp.Server, serverBlocks []serverBlock, options map[string]any) error {
	httpPort := strconv.Itoa(caddyhttp.DefaultHTTPPort)
	if hp, ok := options["http_port"].(int); ok {
		httpPort = strconv.Itoa(hp)
	}
	httpsPort := strconv.Itoa(caddyhttp.DefaultHTTPSPort)
	if hsp, ok := options["https_port"].(int); ok {
		httpsPort = strconv.Itoa(hsp)
	}

	var httpOrHTTPS string
	checkAndSetHTTP := func(addr Address) error {
		if httpOrHTTPS == "HTTPS" {
			errMsg := fmt.Errorf("server listening on %v is configured for HTTPS and cannot natively multiplex HTTP and HTTPS: %s",
				srv.Listen, addr.Original)
			if addr.Scheme == "" && addr.Host == "" {
				errMsg = fmt.Errorf("%s (try specifying https:// in the address)", errMsg)
			}
			return errMsg
		}
		if len(srv.TLSConnPolicies) > 0 {
			// any connection policies created for an HTTP server
			// is a logical conflict, as it would enable HTTPS
			return fmt.Errorf("server listening on %v is HTTP, but attempts to configure TLS connection policies", srv.Listen)
		}
		httpOrHTTPS = "HTTP"
		return nil
	}
	checkAndSetHTTPS := func(addr Address) error {
		if httpOrHTTPS == "HTTP" {
			return fmt.Errorf("server listening on %v is configured for HTTP and cannot natively multiplex HTTP and HTTPS: %s",
				srv.Listen, addr.Original)
		}
		httpOrHTTPS = "HTTPS"
		return nil

View on GitHub (pinned to 50e54ee279)

Solutions

1. Rewrite the bare address as `https://:443`
2. Split the catch-all HTTP and HTTPS sites onto separate ports or servers
3. Drop the bare-address site block if it is redundant

Example fix

# before
:443 {
  respond "catch-all"
}
http://example.com:443 {
  respond "http site"
}
# after
https://:443 {
  respond "catch-all"
}
http://example.com:80 {
  respond "http site"
}

# Reject bare-address keys mixed with http sites
assert not any(key == ":443" for key in block.keys) or no_http_sites_on_443

When it happens

Trigger: A site block key like `:443` (empty scheme and host) used together with HTTP addresses on the same server, so the adapter cannot tell the bare address was meant to be HTTPS and the multiplex conflict message gains the '(try specifying https:// in the address)' suffix.

Common situations: Catch-all site keys such as `:443` mixed with `http://` sites, or wildcard listener blocks written without a scheme that collide with explicit http sites on the same port.

Related errors

• server listening on %v is configured for HTTPS and cannot na
• server listening on %v is configured for HTTP and cannot nat
• consolidating TLS connection policies for server %d: %v
• applying global server options: %v
• server listening on %v is HTTP, but attempts to configure TL

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/d22e0df5adde55e2. Report an issue: GitHub.