Caddy isn't sending the correct zone during ACME challenges?

It depends.

If you have a very public site and don’t care that everyone knows about its subdomains, then no, it probably wouldn’t make much difference.

If you have sites or subdomains that you don’t want to advertise, using a wildcard certificate can help avoid exposing their names.

When a public CA issues a certificate, information about it is published to Certificate Transparency logs. If I know your domain, I can write a one-liner Bash script that pulls a list of certificates and subdomains from those logs.

If all I get back is *.yourdomain.com instead of certificates containing individual hostnames, there are fewer obvious targets for me to poke around. You can reduce the exposure even further by using a wildcard DNS entry for your sites.

It’s never 100% bulletproof, but it reduces the chances of your sites being discovered.

You can see a use-case example here, where Caddy pretty much drops you if you don’t talk to it using the correct name (SNI/Host):

I mean, there are still ways to make Caddy reveal itself even with such a setup, but there’s less chance of it being discovered by script kiddies :slight_smile: