Caddy automatic HTTPS provisioning explained in plain terms

Caddy automates TLS certificate issuance and renewal. It uses the ACME protocol with authorities like Let’s Encrypt or ZeroSSL. For public domains, Caddy performs HTTP or TLS-ALPN challenges by default. The HTTP challenge performs an authoritative DNS lookup for the candidate hostname’s A/AAAA record, then requests a temporary cryptographic resource over port 80 using HTTP. The TLS-ALPN challenge performs an authoritative DNS lookup for the candidate hostname’s A/AAAA record, then requests a temporary cryptographic resource over port 443 using a TLS handshake. If you use the DNS challenge, Caddy needs credentials to set TXT records. This feature eliminates the need for separate tools.

Caddy also provides On-Demand TLS. This feature issues a certificate during the first TLS handshake for a hostname that lacks one. You must enable this using max_certs or ask in the site block. It works well when you do not know all domain names at startup. When a TLS handshake is received for a server name that Caddy does not yet have a certificate for, the server holds the handshake for a few seconds while it obtains a certificate to complete the process.

Rate limits exist.

At most one certificate challenge happens at a time. After 10 successful challenges, Caddy waits 10 minutes before another challenge. A name that fails a challenge stays blocked for 5 minutes.

Local and public certificate management

Caddy serves internal hostnames like localhost or 127.0.0.1 using self-signed certificates. It uses a local CA powered by Smallstep libraries to sign these certificates. The server may prompt for a password to install this root certificate into your local trust store. You can remove this root anytime using the caddy untrust command. The trust chain includes a root and an intermediate certificate. Caddy stores these in the .caddy/pki/authorities/local directory. Any client accessing the site without trusting the Caddy root CA certificate will show security errors.

Public certificates require different handling.

The industry moves toward shorter lifespans. The industry begins a new phase in March 2026, when domain validation data reuse periods drop to 200 days, then 100 days in 2027, and 10 days in 2029. This shift forces organizations to adopt automation. Starting in March 2026, SSL/TLS certificate validity periods will reduce to 47 days in phases. By 2029, the maximum validity will reach 1.5 months.

Do you need to worry about the 47-day limit if you use Caddy?

Comparing performance and configuration

Nginx holds a 32.8% market share as of April 2026. Caddy holds less than 1% of the market. Caddy 2.11.2 arrived in August 2025, and Nginx 1.30.0 arrived in April 2026, so there is a significant gap between the two modern releases.

I find the configuration simplicity of Caddy to be its strongest asset. You write a few lines in a Caddyfile and the server handles the rest. Nginx requires manual certificate management and separate tools to achieve the same result.

Performance varies by workload. A benchmark from April 2026 showed Caddy 2.8 handling 142,000 requests per second for 1KB static files on 16-core ARM hardware. This performance beat Nginx 1.26 by 22% in that specific test. However, Nginx 1.30.4 handled 55,577 requests per second while Caddy 2.11.4 handled only 18,169 requests per second in a different March 2026 test. Caddy’s implementation in Go provides memory safety that a C-based server like Nginx cannot match, and it has shipped only 4 CVEs since 2020, while Nginx has shipped 47 in the same window.

Caddy manages the issuance, renewal, OCSP stapling, and redirects for your certificates without any extra configuration or separate tooling required for the job, and this makes it a very simple choice.

Caddy’s binary reaches about 45 MB because it statically links the Go runtime, the garbage collector, and the entire standard library into a single, large package for the user. Nginx remains much smaller, using about 2 to 3 MB of RAM at idle. Caddy uses 25 to 35 MB of RAM at idle.

Caddy automates TLS.

Nginx wins.