kataras/iris · error

autotls: use iris.AutoTLSNoRedirect instead

Error message

autotls: use iris.AutoTLSNoRedirect instead

What it means

When running automatic TLS, the supervisor starts a fallback HTTP/1.1 server for HTTP->HTTPS (ACME challenge / HTTP2) redirection. If redirection was explicitly disabled (AutoTLSNoRedirect) but no Fallback was registered, the supervisor cannot operate and returns this error.

Source

Thrown at core/host/supervisor.go:411

			return http1Handler
		}
	}

	if challengeHandler != nil {
		http1Server := &http.Server{
			Addr:              ":http",
			Handler:           challengeHandler(nil), // nil for redirection.
			ReadTimeout:       su.Server.ReadTimeout,
			ReadHeaderTimeout: su.Server.ReadHeaderTimeout,
			WriteTimeout:      su.Server.WriteTimeout,
			IdleTimeout:       su.Server.IdleTimeout,
			MaxHeaderBytes:    su.Server.MaxHeaderBytes,
		}

		if su.Fallback == nil {
			if !su.manuallyTLS && su.disableHTTP1ToHTTP2Redirection {
				// automatic redirection was disabled but Fallback was not registered.
				return fmt.Errorf("autotls: use iris.AutoTLSNoRedirect instead")
			}
			go http1Server.ListenAndServe()
		} else {
			// if it's manual TLS still can have its own Fallback server here,
			// the handler will be the redirect one, the difference is that it can run on any port.
			srv := su.Fallback(challengeHandler)
			if srv == nil {
				if !su.manuallyTLS {
					return fmt.Errorf("autotls: relies on an HTTP/1.1 server")
				}
				// for any case the end-developer decided to return nil here,
				// we proceed with the automatic redirection.
				srv = http1Server
				go srv.ListenAndServe()
			} else {
				if srv.Addr == "" {
					srv.Addr = ":http"
				}

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Remove the AutoTLSNoRedirect option so the automatic HTTP->HTTPS redirection server is used.
2. Register a Fallback server for the supervisor (host.Supervisor.Fallback or the configuration that supplies it) that serves the ACME challenge.
3. If redirection is truly unwanted and no fallback is needed, run a plain ListenAndServeTLS with your own certificates instead of AutoTLS.

Example fix

// before
app.Run(iris.AutoTLS(":443", "example.com", "mail@example.com"), iris.WithAutoTLSNoRedirect())
// after
app.Run(iris.AutoTLS(":443", "example.com", "mail@example.com")) // allow automatic redirection

if disableRedirect && fallbackServer == nil {
    return errors.New("AutoTLSNoRedirect requires a registered Fallback server")
}

err := app.Run(iris.AutoTLS(":443", domain, email))
if err != nil && strings.Contains(err.Error(), "AutoTLSNoRedirect") {
    // reconfigure: remove the NoRedirect option or register a Fallback
}

When it happens

Trigger: Calling ListenAndServeAutoTLS after setting iris.AutoTLSNoRedirect (supervisor.disableHTTP1ToHTTP2Redirection) without providing a Fallback server via su.Fallback / configuration.

Common situations: Disabling redirection to avoid extra listeners but forgetting the fallback; copy-pasting AutoTLSNoRedirect option from docs without setting up a custom challenge handler.

Related errors

• autotls: relies on an HTTP/1.1 server
• directoryPath is empty
• path is required
• auth: signin: no provider
• auth: refresh: disabled

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/f3602a20a63cd0ed. Report an issue: GitHub.