natbox.io

Guides / Caddy

Automatic HTTPS with Caddy

About 5 minutes. Debian or Ubuntu commands.

Caddy is a web server that gets and renews Let's Encrypt certificates on its own. It is the quickest way to put HTTPS in front of an app running on your server.

1. Link your domain first

On your server's Domains tab, add each name (for example app.example.com), create the A and TXT records it shows, and press Verify. Caddy needs ports 80 and 443 to reach you; see Host a website step 1.

2. Install Caddy

apt update && apt install -y debian-keyring debian-archive-keyring apt-transport-https curl gpg
curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt > /etc/apt/sources.list.d/caddy-stable.list
apt update && apt install -y caddy

Stop nginx or Apache first if they are installed, since only one program can use ports 80 and 443.

3. Configure it

Replace /etc/caddy/Caddyfile with one of these:

# a static site
example.com, www.example.com {
	root * /var/www/html
	file_server
}

# or an app listening on localhost:3000
app.example.com {
	reverse_proxy 127.0.0.1:3000
}
systemctl reload caddy
journalctl -u caddy -n 30   # shows the certificate being issued

Open https://example.com: the certificate is valid within a minute and renews by itself.

Good to know