kataras/iris · error

autotls: relies on an HTTP/1.1 server

Error message

autotls: relies on an HTTP/1.1 server

What it means

During TLS startup, if a Fallback function was registered but returns nil (and the TLS run is not manual), the supervisor has no HTTP/1.1 server to answer the ACME challenge/redirect and returns this error.

Source

Thrown at core/host/supervisor.go:420

			ReadHeaderTimeout: su.Server.ReadHeaderTimeout,
			WriteTimeout:      su.Server.WriteTimeout,
			IdleTimeout:       su.Server.IdleTimeout,
			MaxHeaderBytes:    su.Server.MaxHeaderBytes,
		}

		if su.Fallback == nil {
			if !su.manuallyTLS && su.disableHTTP1ToHTTP2Redirection {
				// automatic redirection was disabled but Fallback was not registered.
				return fmt.Errorf("autotls: use iris.AutoTLSNoRedirect instead")
			}
			go http1Server.ListenAndServe()
		} else {
			// if it's manual TLS still can have its own Fallback server here,
			// the handler will be the redirect one, the difference is that it can run on any port.
			srv := su.Fallback(challengeHandler)
			if srv == nil {
				if !su.manuallyTLS {
					return fmt.Errorf("autotls: relies on an HTTP/1.1 server")
				}
				// for any case the end-developer decided to return nil here,
				// we proceed with the automatic redirection.
				srv = http1Server
				go srv.ListenAndServe()
			} else {
				if srv.Addr == "" {
					srv.Addr = ":http"
				}
				// } else if !su.manuallyTLS && srv.Addr != ":80" && srv.Addr != ":http" {
				// 	hostname, _, _ := net.SplitHostPort(su.Server.Addr)
				// 	return fmt.Errorf("autotls: The HTTP-01 challenge relies on http://%s:80/.well-known/acme-challenge/", hostname)
				// }

				if srv.Handler == nil {
					// handler was nil, caller wanted to change the server's options like read/write timeout.
					srv.Handler = http1Server.Handler
					go srv.ListenAndServe() // automatically start it, we assume the above ^

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Fix the Fallback function so it always returns a valid *http.Server (or non-nil) for the challenge handler.
2. If you intend to run manually with your own certs, set the manual TLS option so the nil fallback is tolerated.
3. Remove the Fallback override and let iris run the default automatic HTTP/1.1 redirect server.

Example fix

// before
su.Fallback(func(h http.Handler) *http.Server { return nil })
// after
su.Fallback(func(h http.Handler) *http.Server {
    return &http.Server{Addr: ":80", Handler: h}
})

if su.Fallback != nil {
    // ensure your Fallback function never returns a nil *http.Server
}

err := app.Run(iris.AutoTLS(...))
if err != nil && strings.Contains(err.Error(), "relies on an HTTP/1.1 server") {
    log.Fatal("custom Fallback must return a non-nil *http.Server")
}

When it happens

Trigger: ListenAndServeTLS/ListenAndServeAutoTLS path where su.Fallback(challengeHandler) is set but returns nil and su.manuallyTLS is false.

Common situations: A custom Fallback function that returns nil on error or forgets to build/return the server; conditional logic in Fallback that skips returning a server in some environments.

Related errors

• autotls: use iris.AutoTLSNoRedirect instead
• directoryPath is empty
• path is required
• auth: signin: no provider
• auth: refresh: disabled

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/4ee18711d89574ec. Report an issue: GitHub.