How Caddy automatic HTTPS works and the shift from Nginx
Caddy automates TLS management using ACME challenges and On-Demand TLS, offering 142,000 req/s in static file benchmarks. While Nginx uses less idle RAM, Caddy provides easier configuration and fewer CVEs for modern self-hosting.
Automated Certificate Management
Caddy manages TLS certificates through an integrated ACME client. It uses Let’s Encrypt or ZeroSSL for public domains. For local or internal hostnames like localhost or 127.0.0.1, Caddy generates its own certificate authority using Smallstep libraries. This local CA creates a trust chain consisting of a root and intermediate certificate. Caddy uses the intermediate to sign leaf certificates. Caddy generates the root key using a cryptographically-secure pseudorandom source. Caddy stores the root key in storage with limited permissions. Caddy attempts renewals 30 days before expiry. Nginx requires separate tools like Certbot and manual cron jobs to handle these same tasks.
An ACME client creates an account and submits a certificate order. The server responds with challenges for the client to complete to prove control over identifiers. Caddy selects between the HTTP challenge and the TLS-ALPN challenge by default. The HTTP challenge requires port 80 to be open and accessible. The ACME server challenges the client to host a random number at a random URL on the domain, and it then verifies client control by issuing an HTTP GET request to that URL. The TLS-ALPN challenge requires port 443 to be open. It uses a TLS handshake containing special ServerName and ALPN values. The DNS challenge performs an authoritative DNS lookup for the candidate hostname’s TXT records. This challenge requires configuration and Caddy needs credentials to access your domain’s DNS provider. CNAME records can delegate answering the challenge to other DNS zones.
Caddy provides certificates for public domain names by performing authoritative DNS lookups and then requesting a temporary cryptographic resource over port 80 or port 443 through the ACME protocol for every configured domain.
One specific weakness exists.
Performance and Resource Use
Caddy’s Go codebase trades absolute throughput for safety and developer ergonomics. A Caddy server idle uses 25 to 35 MB of RAM. Nginx uses 2 to 3 MB of RAM at idle. This difference is ten times greater. Caddy’s compiled binary is around 45 MB because Go statically links its runtime, garbage collector, and the entire standard library. Nginx compiles to a tight binary typically under 1 MB. Caddy has shipped 4 CVEs since 2020 while Nginx has shipped 47 CVEs in the same window. Caddy handles concurrency with goroutines. Nginx uses an event-driven, single-threaded-per-worker model.
| Metric | Caddy 2.11.2 | Nginx 1.30.0 |
|---|---|---|
| Static File Throughput (1KB) | 142,000 req/s | 116,000 req/s |
| Idle RAM Usage | 25-35 MB | 2-3 MB |
| Market Share (W3Techs 2026) | < 1% | 32.8% |
Caddy 2.8 achieved 142,000 requests per second on 1KB static files during a 16-core ARM benchmark in April 2026. Nginx 1.26 reached 116,000 requests per second in the same test. Caddy’s TLS 1.3 handshake completion time was 18 ms median in the Vlaicu.io test. Nginx’s median TLS 1.3 handshake time was 21 ms. Nginx remains the better choice for heavy large-file streaming because it uses 38% less memory during 1 GB plus streaming workloads.
Nginx wins on large files.
Deployment and Configuration
Caddy pioneered On-Demand TLS. This feature obtains a new certificate during the first TLS handshake. This works without hard-coding domain names in the configuration. Caddy holds the handshake for a few seconds while it obtains the certificate. This is useful if you do not know all the domain names when you start your server. To prevent abuse, you must enable and restrict On-Demand TLS via TLS automation policies.
You should know that Caddy handles HTTP to HTTPS redirects automatically. For a simple reverse proxy, Caddy needs only three lines of configuration. Nginx requires much more. You must configure the server block, specify the certificate paths, and manage the reload behavior. Caddy uses a declarative format called the Caddyfile. A basic Caddy reverse proxy only needs the domain and the reverse_proxy directive. Caddy is the best choice for new projects, small teams, and single-VM application stacks. Nginx is the stronger default when teams have Nginx expertise or a mature Nginx estate.
Caddy is the winner.
Will the memory overhead matter as your container count grows?
Technewsdaily
Senior tech writer covering AI, gadgets and cybersecurity. Breaking down the news that matters, every day.
