1. The problem I’m having:
I have recently setup Caddy with Let’s Encrypt and custom domain for my SSL needs, however facing weird delay before every page refresh when visiting a web app via iPhone. This is my setup:
- Let’s Encrypt certs via DNS-01 (netcup)
- OPNsense + Unbound for internal DNS (split-horizon, resolves fine)
- Hosting a internal web app (e.g. Otterwiki) on a Debian LXC (Proxmox)
Problem: On my MDM-managed iPhone, reloading the page (even same page) most of the time results in 2 second delay before the page loads. The delay is always consistently 2 seconds. When accessing via MacBook there is no such issue and it’s lightning fast.
What I tested:
- Direct IP to web app - no issues
- Through Caddy over plain HTTP - no issues
- SSL via Caddy’s internal ACME CA (step-ca, via hostname otter.home.arpa) - no issues, so it’s really the Let’s Encrypt DNS-01 path which is slow.
- Disabled HTTP/3, iCloud Private Relay, IP tracking - same issue
- Tried different browsers on iPhone - same issue
- If I block all internet access from iPhone - same issue
The cert has a CRL distribution point (ye1.c.lencr.org), so could it be that my iPhone is doing a synchronous CRL fetch that times out/downloads on every new page hit (which is enforced by MDM)? However, I don’t see any requests going to Let’s Encrypt via Internet, so I am not sure.
Any ideas what it could be and how I could further troubleshoot this?
2. Error messages and/or full log output:
No errors present.
3. Caddy version:
v2.11.4
4. How I installed and ran Caddy:
Installed as a Systemd service on Debian 13.5 (trixie) using official instructions.
a. System environment:
Caddy is running as a Systemd service on Debian 13.5.
b. Command:
N/A
c. Service/unit/compose file:
PASTE OVER THIS HERE IN THIS CODE BLOCK.
Please ensure it looks nice.
d. My complete Caddy config:
{
email redacted@pm.me
}
(homelab_tls) {
tls {
ca https://localhost:8443/acme/acme/directory
ca_root /usr/local/share/ca-certificates/homelab-root.crt
}
}
*.lab.custom.eu {
tls {
dns netcup {
customer_number {env.NETCUP_CUSTOMER_NUMBER}
api_key {env.NETCUP_API_KEY}
api_password {env.NETCUP_API_PASSWORD}
}
propagation_delay 30s
propagation_timeout 5m
resolvers 1.1.1.1 8.8.8.8
}
@non_admin_not_media {
not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24
not host otter.lab.custom.eu
}
handle @non_admin_not_media {
respond "Forbidden" 403
}
@otter host otter.lab.custom.eu
handle @otter {
reverse_proxy 192.168.20.93:8080
}
handle {
respond "Unknown service" 404
}
}
mylab.home.arpa {
import homelab_tls
# Only admin WireGuard peers may access Proxmox.
@non_admin {
not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24
}
handle @non_admin {
respond "Forbidden" 403
}
handle {
reverse_proxy https://192.168.10.10:8006 {
transport http {
tls_insecure_skip_verify
}
}
}
}
5. Links to relevant resources:
N/A