About multiple hosts sharing the same TLS certificates storage

[Whitestrake (Matthew Fay)]

Technically doable, but as you note, there’s a decent chance of a race to renew the same certificate. At the moment there’s no way to configure Caddy with a random cert renewal interval. You could stagger the startup of your replicas to help reduce the likelihood.

The best solution would be a TLS asset storage provider. From another thread regarding clustering Caddy:

@matt

Good news: Caddy’s TLS asset storage is designed to be pluggable. Meaning you can plug in a TLS storage provider that takes care of the replication and syncing between Caddy instances, especially useful if the storage is a shared resource.

Bad news: It’s not fully developed yet; you’ll have to change some of the code and compile Caddy yourself, after writing the storage plugin you want.

More good news though: In a little while, we’ll be launching a subscription product for companies who rely on Caddy to ensure their features get considered first and get their bugs fixed before others, as well as guaranteed continued development and private support.