coredns/coredns · error

loading managed certificates for %q: %w

Error message

loading managed certificates for %q: %w

What it means

start() calls manager.LoadManaged to restore already-issued certificates from storage; if that fails, startup unwinds (stops backend, clears managers) and returns this wrapped error, preserving the underlying cause (e.g. storage or PEM parse failure).

Source

Thrown at plugin/tls/acme.go:385

	ctx, cancel := context.WithCancel(context.Background())
	for _, entry := range entries {
		manager := backend.Manager(entry.key)
		if manager == nil {
			cancel()
			backend.Stop()
			for _, configured := range entries {
				configured.setManager(nil)
			}
			return fmt.Errorf("no ACME certificate manager for %q", entry.options.domains)
		}
		entry.setManager(manager)
		if err := manager.LoadManaged(ctx, entry.options.domains); err != nil {
			cancel()
			backend.Stop()
			for _, configured := range entries {
				configured.setManager(nil)
			}
			return fmt.Errorf("loading managed certificates for %q: %w", entry.options.domains, err)
		}
	}
	r.backend = backend
	r.cancel = cancel
	r.started = true
	var errs []error
	for _, entry := range entries {
		entry.mu.RLock()
		manager := entry.manager
		entry.mu.RUnlock()
		if err := manager.ManageAsync(ctx, entry.options.domains); err != nil {
			errs = append(errs, fmt.Errorf("starting ACME management for %q: %w", entry.options.domains, err))
		}
	}
	return errors.Join(errs...)
}

func (r *acmeRuntime) stop() error {

View on GitHub (pinned to 558c9757a9)

Solutions

1. Inspect the wrapped underlying error for the failing domain/asset and repair the storage (delete corrupt certs to force reissue)
2. Fix permissions/read access on the certmagic storage directory
3. Verify the storage backend (file path/S3 etc.) is reachable with correct credentials

Example fix

// before
// storage dir /data/certs owned by root, service runs as nobody
// after
chown -R nobody:nobody /data/certs  # or run service as owner

// preflight storage access
st := certmagic.FileStorage{Path: cfg.StoragePath}
if _, err := st.Stat(ctx, ""); err != nil { return fmt.Errorf("storage unreadable: %w", err) }

if err := runtime.start(ctx); err != nil {
  var wrapped interface{ Unwrap() error }
  log.Printf("start failed: %v", err) // inspect "loading managed certificates for" cause
  // optionally clear corrupt assets for the failing domain, then retry
  return err
}

When it happens

Trigger: certmagic storage contains corrupt/unreadable certificate assets for the entry's domains, or the storage backend is unreachable during LoadManaged.

Common situations: Corrupted cert.pem/key.pem in the storage dir after a crashed write; permissions changed on the storage path; switched storage backends losing sync.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ACME certificate is not ready
• server name is not managed by this ACME configuration
• ACME requires at least one domain
• cannot add ACME configuration after startup
• resolving ACME storage directory: %w

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/20b5b537adc9908f. Report an issue: GitHub.