juanfont/headscale · warning · ErrNoCertDomains

no cert domains available for HTTPS

Error message

no cert domains available for HTTPS

What it means

ErrNoCertDomains is a sentinel error in hscontrol/tailsql.go:17 returned at tailsql.go:76 when the embedded tailsql tsnet node has ServeHTTPS enabled but tsNode.CertDomains() returns an empty list, so no TLS certificate domain is available to build the HTTPS base URL for the TailSQL UI.

Source

Thrown at hscontrol/tailsql.go:17

package hscontrol

import (
	"context"
	"errors"
	"fmt"
	"net/http"
	"os"

	"github.com/tailscale/tailsql/server/tailsql"
	"tailscale.com/tsnet"
	"tailscale.com/tsweb"
	"tailscale.com/types/logger"
)

// ErrNoCertDomains is returned when no cert domains are available for HTTPS.
var ErrNoCertDomains = errors.New("no cert domains available for HTTPS")

func runTailSQLService(ctx context.Context, logf logger.Logf, stateDir, dbPath string) error {
	opts := tailsql.Options{
		Hostname: "tailsql-headscale",
		StateDir: stateDir,
		Sources: []tailsql.DBSpec{
			{
				Source: "headscale",
				Label:  "headscale - sqlite",
				Driver: "sqlite",
				URL:    fmt.Sprintf("file:%s?mode=ro", dbPath),
				Named: map[string]string{
					"schema": `select * from sqlite_schema`,
				},
			},
		},
	}

View on GitHub (pinned to 565fd254d0)

Solutions

1. Enable MagicDNS and HTTPS certificate provisioning on the tailnet so CertDomains is non-empty
2. Verify the tailsql tsnet node is authorized and reaches Running state before checking CertDomains
3. Alternatively disable HTTPS serving for tailsql and use plain HTTP/port 80
4. Check dns.magic_dns and base_domain settings in the headscale config

Example fix

null

// Enable tailsql HTTPS only when the tailnet advertises cert domains
if len(tsNode.CertDomains()) == 0 {
    opts.ServeHTTPS = false
}

null

if errors.Is(err, ErrNoCertDomains) { /* fall back to HTTP or enable MagicDNS/HTTPS certs on the tailnet */ }

When it happens

Trigger: Enabling the tailsql debug feature with HTTPS serving while the tsnet node has no provisioned cert domain — typically because MagicDNS/HTTPS certificates are not enabled on the tailnet, the node is not authorized, or the control plane advertises no DNSConfig.CertDomains.

Common situations: Running headscale's tailsql integration against a tailnet where HTTPS certs (LetsEncrypt via tailnet name) are disabled; tailnet not fully joined yet when CertDomains is queried; base_domain/MagicDNS misconfiguration so no cert domain is advertised.

Related errors

• server_url cannot be part of base_domain in a way that could
• server_url cannot use the same domain as base_domain in a wa
• STUN address not set
• initial DERPMap is empty, Headscale requires at least one en
• failed to parse ApiKey

AI-assisted analysis of juanfont/headscale@565fd254d0 (2026-08-15). Data as JSON: /api/errors/0664401d610cdd08. Report an issue: GitHub.