caddyserver/caddy · error

secure request failed: %v

Error message

secure request failed: %v

What it means

downloadBuild() performs a plain http.Get against https://caddyserver.com/api/download; this error wraps any transport-level failure before a response is received. It means the HTTPS request itself failed — DNS resolution, TCP connection, TLS handshake, or a client timeout — not an HTTP error status.

Source

Thrown at cmd/packagesfuncs.go:288

	return cmd.Run()
}

func showVersion(path string) error {
	cmd := exec.Command(path, "version")
	cmd.Stdout = os.Stdout
	cmd.Stderr = os.Stderr
	return cmd.Run()
}

func downloadBuild(qs url.Values) (*http.Response, error) {
	l := caddy.Log()
	l.Info("requesting build",
		zap.String("os", qs.Get("os")),
		zap.String("arch", qs.Get("arch")),
		zap.Strings("packages", qs["p"]))
	resp, err := http.Get(fmt.Sprintf("%s?%s", downloadPath, qs.Encode()))
	if err != nil {
		return nil, fmt.Errorf("secure request failed: %v", err)
	}
	if resp.StatusCode >= 400 {
		var details struct {
			StatusCode int `json:"status_code"`
			Error      struct {
				Message string `json:"message"`
				ID      string `json:"id"`
			} `json:"error"`
		}
		err2 := json.NewDecoder(resp.Body).Decode(&details)
		if err2 != nil {
			return nil, fmt.Errorf("download and error decoding failed: HTTP %d: %v", resp.StatusCode, err2)
		}
		return nil, fmt.Errorf("download failed: HTTP %d: %s (id=%s)", resp.StatusCode, details.Error.Message, details.Error.ID)
	}
	return resp, nil
}

View on GitHub (pinned to 50e54ee279)

Solutions

1. Check basic connectivity: curl -v 'https://caddyserver.com/api/download?os=linux&arch=amd64'
2. Set proxy env vars if behind a corporate proxy: export HTTPS_PROXY=http://proxy:8080 before running caddy
3. Fix DNS (verify /etc/resolv.conf, try a public resolver) or firewall rules allowing 443 to caddyserver.com
4. If TLS interception is in play, add the proxy CA to the system trust store (or use a standard release binary downloaded out-of-band)

Example fix

# before
caddy upgrade
# error: download failed: secure request failed: dial tcp: lookup caddyserver.com: no such host

# after
export HTTPS_PROXY=http://corporate-proxy:8080
caddy upgrade

curl -fsS --max-time 15 'https://caddyserver.com/api/download?os=linux&arch=amd64' -o /dev/null || echo 'download API unreachable; check network/proxy/DNS'

When it happens

Trigger: No internet or egress blocked; DNS failure resolving caddyserver.com; corporate proxy not honored (the code uses http.Get, so only HTTP(S)_PROXY env vars apply); TLS interception with an untrusted CA; firewall dropping 443.

Common situations: Running 'caddy upgrade' on an air-gapped or proxied server without HTTPS_PROXY set; captive portal; broken resolv.conf in a container; MITM proxy whose CA is not in the system trust store.

Related errors

• problem calling http loader url: %v
• download failed: %v
• download and error decoding failed: HTTP %d: %v
• unable to download file: %v
• could not determine zone for domain: %w (domain=%s nameserve

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/4cd687c3dd4e1f53. Report an issue: GitHub.