coredns/coredns · error · errACMENameNotManaged

%w: %q

Error message

%w: %q

What it means

The ACME entry's getCertificate callback refuses to issue certificates for names it does not manage. When the TLS ClientHello carries a ServerName that is not in the entry's configured domains, it returns errACMENameNotManaged wrapped with the requested name.

Source

Thrown at plugin/tls/acme.go:262

type acmeBackendFactory func([]*acmeEntry, *acmeDNS01Solver) (acmeBackend, error)

type acmeEntry struct {
	options acmeOptions
	key     acmeConfigKey

	mu      sync.RWMutex
	manager certificateManager
}

func (e *acmeEntry) setManager(manager certificateManager) {
	e.mu.Lock()
	e.manager = manager
	e.mu.Unlock()
}

func (e *acmeEntry) getCertificate(hello *ctls.ClientHelloInfo) (*ctls.Certificate, error) {
	if hello != nil && hello.ServerName != "" && !e.manages(hello.ServerName) {
		return nil, fmt.Errorf("%w: %q", errACMENameNotManaged, hello.ServerName)
	}
	e.mu.RLock()
	manager := e.manager
	e.mu.RUnlock()
	if manager == nil {
		return nil, fmt.Errorf("%w for %q", errACMENotReady, e.options.domains)
	}
	return manager.GetCertificate(hello)
}

func (e *acmeEntry) manages(serverName string) bool {
	serverName, err := normalizeACMEDomain(serverName)
	if err != nil {
		return false
	}
	for _, domain := range e.options.domains {
		if certmagic.MatchWildcard(serverName, domain) {
			return true

View on GitHub (pinned to 558c9757a9)

Solutions

1. Add the requested hostname to the ACME options' domains list
2. Check normalizeACMEDomain case/trie-suffix handling — configure domains matching what clients request
3. Serve a default (fallback) certificate for unmanaged names if intended

Example fix

// before
domains: ["example.com"]
// after
domains: ["example.com", "www.example.com"]

// before handshake handling, ensure requested names are configured
for _, name := range requestedNames {
  if !slices.ContainsFunc(cfg.ACME.Domains, func(d string) bool {
    return strings.EqualFold(strings.TrimSuffix(d, "."), strings.TrimSuffix(name, "."))
  }) {
    log.Printf("name %q not managed by ACME; will get default cert", name)
  }
}

cert, err := entry.getCertificate(hello)
if errors.Is(err, errACMENameNotManaged) {
  // serve fallback/default certificate or reject handshake
  cert = fallbackCert
}

When it happens

Trigger: A TLS handshake requests a SNI hostname that is not in any ACME entry's configured domains list managed by this acmeEntry's manager.

Common situations: Client connects with a hostname typo, a domain was removed from ACME config but DNS still points at the server, or a wildcard/san variant (e.g. www.) isn't in the domain list.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• server name is not managed by this ACME configuration
• ACME certificate is not ready
• resolving ACME storage directory: %w
• invalid ACME domain %q
• invalid ACME domain %q: %w

AI-assisted analysis of coredns/coredns@558c9757a9 (2026-09-06). Data as JSON: /api/errors/1f717019a2f84643. Report an issue: GitHub.