Serve HTTPS Automatically with Caddy

Point a domain at Caddy, let it obtain and renew certificates automatically, and set a couple of headers and proxies without a separate certbot step.

~25 mintlscaddyautomation

Task

Deploy a service over HTTPS with automatic certificate management.

When to use this

A deployment needs TLS but manual certificate issuance and renewal is error-prone, and expiry has taken the site down before.

Prerequisites

A Caddy binary
A domain whose DNS points at the server

Steps

1. Configure the site block with the hostname and the upstream.

Expected output: Caddy serves the site and knows the domain.

2. Let Caddy obtain the certificate on first request or at startup.

Expected output: TLS is enabled with no manual cert step.

3. Add security headers and a reverse proxy in the same block.

Expected output: The service is exposed correctly with sensible defaults.

4. Watch logs for renewal problems and configure DNS challenges for wildcard hosts.

curl -sI https://app.example.com | grep -i strict-transport-security

Expected output: Renewal is observable and wildcards are supported.

Troubleshooting

Problem

Certificate issuance rate limited

Solution

Use the staging endpoint while testing to avoid hitting the production ACME limits.

Problem

Wildcard needs DNS challenge

Solution

Set the DNS provider module and credentials; HTTP-01 cannot issue wildcards.

Limitations

Automatic HTTPS needs inbound port 80 or 443 for the HTTP challenge, or DNS API access for DNS-01.
It hides certificate details that some compliance processes expect you to manage explicitly.

Context

Deploy a service over HTTPS with automatic certificate management. A deployment needs TLS but manual certificate issuance and renewal is error-prone, and expiry has taken the site down before.

Steps

Configure the site block with the hostname and the upstream. Expected: Caddy serves the site and knows the domain.
Let Caddy obtain the certificate on first request or at startup. Expected: TLS is enabled with no manual cert step.
Add security headers and a reverse proxy in the same block. Expected: The service is exposed correctly with sensible defaults.
Watch logs for renewal problems and configure DNS challenges for wildcard hosts. Expected: Renewal is observable and wildcards are supported.

app.example.com {
  encode gzip
  header Strict-Transport-Security "max-age=31536000; includeSubDomains"
  reverse_proxy 127.0.0.1:3000
}

Verify

Caddy serves the site and knows the domain.
TLS is enabled with no manual cert step.
The service is exposed correctly with sensible defaults.
Renewal is observable and wildcards are supported.

Limits

Automatic HTTPS needs inbound port 80 or 443 for the HTTP challenge, or DNS API access for DNS-01.
It hides certificate details that some compliance processes expect you to manage explicitly.