SSL certificates on Caddy

Caddy obtains, installs and renews certificates by itself. For most sites the entire TLS configuration is the fact that you wrote a hostname.

example.com {
    root * /var/www/html
    file_server
}

To use a certificate you already have, point tls at the fullchain and the key — Caddy then stops managing it, including renewal.

example.com {
    tls /etc/ssl/certs/fullchain.pem /etc/ssl/private/example.com.key
    reverse_proxy localhost:8080
}

caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy

Automatic mode needs inbound port 80 reachable for the ACME challenge, and a DNS record already pointing at the box. If issuance silently fails, that is almost always why.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what Caddy actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

SSL certificates on Caddy

Verify it from the outside

Other platforms