Caddy: a website with automatic HTTPS

Caddy is a web server that requests a certificate from Let's Encrypt itself and renews it in time. You don't need to set up Certbot. That makes Caddy the easiest choice for a new server.

What do you need first?

• The A and AAAA records of your name point to your VPS (see A and AAAA records in My Domains).
• Ports 80 and 443 are open in your firewall (see A firewall with ufw (or nftables)). Let's Encrypt uses port 80 to check that you really control the name.
• No other web server, such as nginx or Apache, is running on port 80 or 443.

Installing Caddy

anna@web1:~$ sudo apt install caddy
anna@web1:~$ systemctl status caddy

Caddy is in the Debian and Ubuntu package repositories and starts as a service straight away. If you always want the latest version, use Caddy's own package repository, as described at caddyserver.com/docs/install.

Your first site

Put your files in a folder, for example /srv/www/example.com, and open the configuration file:

anna@web1:~$ sudo mkdir -p /srv/www/example.com
anna@web1:~$ echo '<h1>Het werkt</h1>' | sudo tee /srv/www/example.com/index.html
anna@web1:~$ sudo nano /etc/caddy/Caddyfile

Replace the contents with:

example.com, www.example.com {
	root * /srv/www/example.com
	file_server
	encode zstd gzip
}

anna@web1:~$ caddy validate --config /etc/caddy/Caddyfile
anna@web1:~$ sudo systemctl reload caddy

Open https://example.com. Caddy fetches the certificate on the first visit or within a few seconds of reloading, and automatically redirects http to https.

Not working?

anna@web1:~$ journalctl -u caddy --since "10 minutes ago"

The most common causes: the DNS doesn't point to your VPS yet, port 80 is closed, or something else is already running on port 80. More in Website unreachable, 502 Bad Gateway or certificate error.

Tip: Add a block with your email address at the top of the Caddyfile. That way Let's Encrypt can reach you if there's a problem with your certificates:

{
	email beheer@example.com
}