Won't Start From Service But Will From CLI -- "decoding certificate metadata: unexpected end of JSON input"

Help
3

Yay! ––solved it.

Seeing as how the whole sudo / non-sudo thing suggested a permissions problem and the [spurious!] error message referred to mal-formed JSON in the certificates files, I decided to take a look at my ~/.caddy directory and check out the permissions on the certificates and associated directories:

cd ~/.caddy && ls -al
total 20
drwx------  5 madra madra    4096 Jan 15 21:16 .
drwxr-xr-x 18 madra madra    4096 Jan 18 11:14 ..
drwx------  4 madra madra    4096 Jan 15 20:54 acme
drwx------  2 madra www-data 4096 Jan 15 21:16 locks
drwx------  2 madra madra    4096 Jan 15 21:16 ocsp

So a couple of the directories weren’t owned by the www-data group under which Caddy runs. I did a quick:

sudo chown -R madra:www-data *

and double-checked:

ls -al
total 20
drwx------  5 madra madra    4096 Jan 15 21:16 .
drwxr-xr-x 18 madra madra    4096 Jan 18 11:21 ..
drwx------  4 madra www-data 4096 Jan 15 20:54 acme
drwx------  2 madra www-data 4096 Jan 15 21:16 locks
drwx------  2 madra www-data 4096 Jan 15 21:16 ocsp

Then ran sudo service caddy start again and my server fired up without a problem.

sudo service caddy start
sudo service caddy status
● caddy.service - Caddy Server
   Loaded: loaded (/etc/systemd/system/caddy.service; enabled; vendor preset: enabled)
   Active: active (running) since Sat 2020-01-18 11:16:36 GMT; 3s ago
 Main PID: 24356 (caddy)
    Tasks: 7 (limit: 1148)
   CGroup: /system.slice/caddy.service
           └─24356 /usr/local/bin/caddy -agree -email xxxx@xxxx.net -pidfile=/var/run/caddy/caddy.pid

<snip>

So, for anyone else who runs into this unexpected end of JSON input error. Take a look and see if the user Caddy is running under can actually access the various files and directories in ~/.caddy.

And @Caddy Devs –you might want to take a look at that error message and see if it’s possible to make a distinction between a certificate containing malformed JSON and Caddy being unable to access the certificate in the first place. The current error message is pretty unhelpful and misleading.

1 Like