I can elaborate later, but your use case is definitely supported and where Caddy excels. You need to use the on-demand TLS feature. I’ve linked the relevant sections in the docs and in a Wiki article: