Caddy beats manual workflows in the 2026 certificate landscape

Let’s Encrypt will reduce certificate lifetimes to 47 days in February 2027 and 6 days in February 2028. This reality changes everything for internal tooling teams. Manual workflows involving Certbot fail when these short windows require constant intervention. Certbot relies on systemd timers or cron jobs to run renewal checks twice daily to stay ahead of expiration. These external tools need port 80 open for the HTTP challenge or specific DNS configuration for the DNS challenge. You know how Certbot’s configuration can break when a plugin fails. Certbot also requires manual steps for the manual plugin, which prevents automation via cron jobs. Certbot implements the ACME protocol where a client requests a certificate, the CA provides a token, and the client provides proof via HTTP or DNS.

The timeline is aggressive.

Caddy automates TLS for public and internal sites. For public domains, Caddy uses ACME through Let’s Encrypt or ZeroSSL. For local hosts like localhost or 127.0.0.1, Caddy uses a local CA powered by Smallstep libraries. This local CA generates a root and intermediate certificate to sign leaf certificates. The root private key is generated using a cryptographically-secure pseudorandom source and stays in memory only to perform signing tasks. Because Let’s Encrypt will transition to 6-day certificates in February 2028, any operations team still relying on manual Certbot workflows or brittle cron jobs will face constant service disruptions unless they switch to a server with native, automated TLS management.

Caddy handles it.

Caddy 2.11.2 shows performance gains over Nginx 1.30.0 in certain tests. In an April 2026 benchmark on 16-core ARM hardware, Caddy 2.8 reached 142,000 requests per second for 1KB files. Nginx 1.26 reached 116,000 requests per second in the same test, which represents a 22% gap. For files larger than 1MB, Nginx leads Caddy by 17% in throughput. While Nginx maintains its dominance in the market with a 32.8% share, Caddy’s 69,500 GitHub stars and native HTTP/3 stack pull new deployments away from the incumbent every quarter.

I recommend Caddy.

Caddy provides functions for scaling. On-demand TLS allows the server to request a certificate during the first TLS handshake for a domain it does not recognize. This is useful for SaaS platforms or multi-tenant apps where customers bring their own domains. Caddy holds the handshake for a few seconds to obtain the certificate, then caches it for future use. To prevent abuse, administrators use the ask directive to validate customer domains against a database. This prevents attackers from exhausting rate limits by pointing random domains at the server.

Caddy’s 69,500 GitHub stars and native HTTP/3 stack pull new deployments away from Nginx, which holds a 32.8% market share. While Nginx is better for raw large-file streaming, Caddy is better for developer experience.

Internal teams benefit from Caddy’s local automation. Caddy serves IP addresses and local hostnames over HTTPS using self-signed certificates that are automatically trusted locally if the admin permits it. To install the root certificate into the system trust store, Caddy may prompt for a password once. Users can also use the caddy untrust command to remove the root. The intermediate certificates have shorter lifetimes and renew automatically as needed.

Caddy’s memory usage exceeds Nginx’s. An idle Caddy server uses 25 – 35 MB of RAM, while Nginx uses 2 – 3 MB. This is because Caddy’s Go codebase includes the runtime and standard library in its 45 MB binary. For large-file streaming, Nginx uses 38% less memory because it does not buffer the response body in user space.

Internal certificates have a 12-hour default lifetime. This can cause Chromium browsers to show expiration errors every 12 hours. This issue requires users to configure certificates on a per-domain basis to change the lifetime.

Will Nginx ever integrate a native ACME client?