You’ve still helped me a lot by pointing me towards diagnostics and ways to look at the config.
I’ve managed to configure Caddy to work the way I would have expected it to work by making one very simple change to the generated JSON config from the https:// Caddyfile:
"tls_connection_policies": [
{}, // <-- I added THIS empty policy to the list *before* cert0.
{
"certificate_selection": {
"any_tag": [
"cert0"
]
}
}
],
Which is to say that the full configuration looks like:
{
"apps": {
"http": {
"servers": {
"srv0": {
"automatic_https": {
"disable_redirects": true
},
"listen": [
":443"
],
"routes": [
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"body": "THE OTHER CONFIG! This is {http.request.uri} on {http.request.host}.",
"handler": "static_response"
}
]
}
]
}
],
"match": [
{
"host": [
"other-caddy-ssl.ttdi.us"
]
}
],
"terminal": true
},
{
"handle": [
{
"handler": "subroute",
"routes": [
{
"handle": [
{
"body": "You just requested {http.request.uri} from {http.request.host}.",
"handler": "static_response"
}
]
}
]
}
],
"terminal": true
}
],
"tls_connection_policies": [
{},
{
"certificate_selection": {
"any_tag": [
"cert0"
]
}
}
]
}
}
},
"tls": {
"certificates": {
"load_files": [
{
"certificate": "/etc/letsencrypt/live/caddy-ssl-test.ttdi.us/fullchain.pem",
"key": "/etc/letsencrypt/live/caddy-ssl-test.ttdi.us/privkey.pem",
"tags": [
"cert0"
]
}
]
}
}
},
"logging": {
"logs": {
"default": {
"level": "DEBUG"
}
}
}
}
and here are the logs which show it both successfully requesting a TLS certificate for other-caddy-ssl.ttdi.us and then using both that certificate and the other wildcard certificate to correctly serve requests:
Starting caddy.service - Caddy...
{"level":"info","ts":1766020086.0902586,"msg":"maxprocs: Leaving GOMAXPROCS=1: CPU quota undefined"}
{"level":"info","ts":1766020086.0909383,"msg":"GOMEMLIMIT is updated","package":"github.com/KimMachineGun/automemlimit/memlimit","GOMEMLIMIT":430693171,"previous":9223372036854775807}
caddy.HomeDir=/var/lib/caddy
caddy.AppDataDir=/var/lib/caddy/.local/share/caddy
caddy.AppConfigDir=/var/lib/caddy/.config/caddy
caddy.ConfigAutosavePath=/var/lib/caddy/.config/caddy/autosave.json
caddy.Version=v2.10.2 h1:g/gTYjGMD0dec+UgMw8SnfmJ3I9+M2TdvoRL/Ovu6U8=
runtime.GOOS=linux
runtime.GOARCH=amd64
runtime.Compiler=gc
runtime.NumCPU=1
runtime.GOMAXPROCS=1
runtime.Version=go1.25.0
os.Getwd=/
LANG=C.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/bin
NOTIFY_SOCKET=/run/systemd/notify
USER=caddy
LOGNAME=caddy
HOME=/var/lib/caddy
INVOCATION_ID=31b4c0e7f1234b8c981d616d999bdfd0
JOURNAL_STREAM=9:640841
SYSTEMD_EXEC_PID=43918
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/caddy.service/memory.pressure
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
{"level":"info","ts":1766020086.0910728,"msg":"using config from file","file":"/etc/caddy/caddy-config.json"}
{"level":"info","ts":1766020086.0946848,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"debug","ts":1766020086.0958269,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [caddy-ssl-test.ttdi.us *.caddy-ssl-test.ttdi.us]: no OCSP server specified in certificate"}
{"level":"debug","ts":1766020086.095985,"logger":"events","msg":"event","name":"cached_unmanaged_cert","id":"c959918e-ccfa-4bda-8cb9-fc39079dde39","origin":"tls","data":{"sans":["caddy-ssl-test.ttdi.us","*.caddy-ssl-test.ttdi.us"]}}
{"level":"debug","ts":1766020086.0960832,"logger":"tls.cache","msg":"added certificate to cache","subjects":["caddy-ssl-test.ttdi.us","*.caddy-ssl-test.ttdi.us"],"expiration":1773639395,"managed":false,"issuer_key":"","hash":"b5aec2f7eda574fd204f67e78611f523e7813672e224f5c55d51618488363bab","cache_size":1,"cache_capacity":10000}
{"level":"info","ts":1766020086.0961905,"logger":"http.auto_https","msg":"automatic HTTP->HTTPS redirects are disabled","server_name":"srv0"}
{"level":"debug","ts":1766020086.0962112,"logger":"http.auto_https","msg":"adjusted config","tls":{"automation":{"policies":[{}]}},"http":{"servers":{"srv0":{"listen":[":443"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"body":"THE OTHER CONFIG! This is {http.request.uri} on {http.request.host}.","handler":"static_response"}]}]}],"terminal":true},{"handle":[{"handler":"subroute","routes":[{"handle":[{"body":"You just requested {http.request.uri} from {http.request.host}.","handler":"static_response"}]}]}],"terminal":true}],"tls_connection_policies":[{},{"certificate_selection":{"any_tag":["cert0"]}}],"automatic_https":{"disable_redirects":true}}}}}
{"level":"debug","ts":1766020086.0966868,"logger":"http","msg":"starting server loop","address":"[::]:443","tls":true,"http3":false}
{"level":"info","ts":1766020086.0967069,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1766020086.0968816,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"info","ts":1766020086.0968885,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["other-caddy-ssl.ttdi.us"]}
{"level":"debug","ts":1766020086.0969713,"logger":"events","msg":"event","name":"started","id":"b50c453f-3eb6-4c48-9d97-0d82374e22a1","origin":"","data":null}
{"level":"info","ts":1766020086.0971167,"msg":"autosaved config (load with --resume flag)","file":"/var/lib/caddy/.config/caddy/autosave.json"}
Started caddy.service - Caddy.
{"level":"info","ts":1766020086.1016057,"msg":"serving initial configuration"}
{"level":"info","ts":1766020086.103653,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00033c980"}
{"level":"info","ts":1766020086.1055908,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/var/lib/caddy/.local/share/caddy"}
{"level":"info","ts":1766020086.1077085,"logger":"tls.obtain","msg":"acquiring lock","identifier":"other-caddy-ssl.ttdi.us"}
{"level":"info","ts":1766020086.1094139,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"info","ts":1766020086.110033,"logger":"tls.obtain","msg":"lock acquired","identifier":"other-caddy-ssl.ttdi.us"}
{"level":"info","ts":1766020086.110158,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"other-caddy-ssl.ttdi.us"}
{"level":"debug","ts":1766020086.1101956,"logger":"events","msg":"event","name":"cert_obtaining","id":"e42f6359-2025-479e-9d4d-3ee043480b3a","origin":"tls","data":{"identifier":"other-caddy-ssl.ttdi.us"}}
{"level":"debug","ts":1766020086.1104434,"logger":"tls","msg":"created CSR","identifiers":["other-caddy-ssl.ttdi.us"],"san_dns_names":["other-caddy-ssl.ttdi.us"],"san_emails":[],"common_name":"","extra_extensions":0}
{"level":"debug","ts":1766020086.1108763,"logger":"tls.obtain","msg":"trying issuer 1/1","issuer":"acme-v02.api.letsencrypt.org-directory"}
{"level":"info","ts":1766020086.1109946,"logger":"http","msg":"creating new account because no account for configured email is known to us","email":"","ca":"https://acme-v02.api.letsencrypt.org/directory","error":"open /var/lib/caddy/.local/share/caddy/acme/acme-v02.api.letsencrypt.org-directory/users/default/default.json: no such file or directory"}
{"level":"info","ts":1766020086.111047,"logger":"http","msg":"ACME account has empty status; registering account with ACME server","contact":[],"location":""}
{"level":"info","ts":1766020086.1132576,"logger":"http","msg":"creating new account because no account for configured email is known to us","email":"","ca":"https://acme-v02.api.letsencrypt.org/directory","error":"open /var/lib/caddy/.local/share/caddy/acme/acme-v02.api.letsencrypt.org-directory/users/default/default.json: no such file or directory"}
{"level":"debug","ts":1766020086.3012018,"msg":"http request","method":"GET","url":"https://acme-v02.api.letsencrypt.org/directory","headers":{"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["1033"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020086.359854,"msg":"http request","method":"HEAD","url":"https://acme-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["3ZGp365BJEEiOjlNbCB-EvFwWRQliafCTzna25N_V3LHMdReZWo"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020086.4657905,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/new-acct","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["235"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf>;rel=\"terms-of-service\""],"Location":["https://acme-v02.api.letsencrypt.org/acme/acct/2888069156"],"Replay-Nonce":["WDq8UPGSKmCDCLXw4t-hA6JrLKnMxPorQ20IgK4QQbnOioqxlF0"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"info","ts":1766020086.466472,"logger":"http","msg":"new ACME account registered","contact":[],"status":"valid"}
{"level":"info","ts":1766020086.4715757,"logger":"http","msg":"waiting on internal rate limiter","identifiers":["other-caddy-ssl.ttdi.us"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1766020086.4716125,"logger":"http","msg":"done waiting on internal rate limiter","identifiers":["other-caddy-ssl.ttdi.us"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1766020086.4716501,"logger":"http","msg":"using ACME account","account_id":"https://acme-v02.api.letsencrypt.org/acme/acct/2888069156","account_contact":[]}
{"level":"debug","ts":1766020086.4716792,"msg":"creating order","account":"https://acme-v02.api.letsencrypt.org/acme/acct/2888069156","identifiers":["other-caddy-ssl.ttdi.us"]}
{"level":"debug","ts":1766020086.600487,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["357"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-v02.api.letsencrypt.org/acme/order/2888069156/459931559606"],"Replay-Nonce":["WDq8UPGSA4wpZXuvF-jQfG8Wkd35MRxIaPH9Cegjvxwh7t8nmcw"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1766020086.661558,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["831"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["WDq8UPGSliITfxMziEeD3Qi69k7cgIfewkB6XUbp9OpAoWCGjyc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1766020086.662296,"msg":"trying to solve challenge","identifier":"other-caddy-ssl.ttdi.us","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"debug","ts":1766020086.6658692,"msg":"waiting for solver before continuing","identifier":"other-caddy-ssl.ttdi.us","challenge_type":"tls-alpn-01"}
{"level":"debug","ts":1766020086.6659107,"msg":"done waiting for solver","identifier":"other-caddy-ssl.ttdi.us","challenge_type":"tls-alpn-01"}
{"level":"debug","ts":1766020086.6666203,"logger":"http.stdlib","msg":"http: TLS handshake error from 127.0.0.1:44724: EOF"}
{"level":"debug","ts":1766020086.7302167,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2888069156/629084642316/YFEl_g","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["199"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:06 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316>;rel=\"up\""],"Location":["https://acme-v02.api.letsencrypt.org/acme/chall/2888069156/629084642316/YFEl_g"],"Replay-Nonce":["3ZGp365B-0IsB8SnwtrK-GCX-ARiMCaE4ygHDXk8AmA1nzN9pZ4"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020086.7309942,"msg":"challenge accepted","identifier":"other-caddy-ssl.ttdi.us","challenge_type":"tls-alpn-01"}
{"level":"debug","ts":1766020086.888917,"logger":"events","msg":"event","name":"tls_get_certificate","id":"6bd82f93-2020-4488-976a-539cb236273f","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":["acme-tls/1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2600:3000:2710:200::86","Port":43537,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"info","ts":1766020086.8892076,"logger":"tls","msg":"served key authentication certificate","server_name":"other-caddy-ssl.ttdi.us","challenge":"tls-alpn-01","remote":"[2600:3000:2710:200::86]:43537","distributed":false}
{"level":"debug","ts":1766020087.0404513,"logger":"events","msg":"event","name":"tls_get_certificate","id":"7ea08eda-8616-44ad-9fb1-8029d464fdc4","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":["acme-tls/1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2600:1f16:269:da02:cdf7:9dda:4664:41f5","Port":18050,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"info","ts":1766020087.0405061,"logger":"tls","msg":"served key authentication certificate","server_name":"other-caddy-ssl.ttdi.us","challenge":"tls-alpn-01","remote":"[2600:1f16:269:da02:cdf7:9dda:4664:41f5]:18050","distributed":false}
{"level":"debug","ts":1766020087.0448737,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["831"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:07 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["WDq8UPGS75urkDwdeoKwBseqtBwSlPZ22YEVOC5ET-6ped8xNXY"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020087.1629868,"logger":"events","msg":"event","name":"tls_get_certificate","id":"2eb2f688-49fe-4c28-b80e-629732357c27","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":["acme-tls/1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2600:1f14:804:fd00:14e1:2f6b:7078:b3df","Port":32672,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"info","ts":1766020087.1637332,"logger":"tls","msg":"served key authentication certificate","server_name":"other-caddy-ssl.ttdi.us","challenge":"tls-alpn-01","remote":"[2600:1f14:804:fd00:14e1:2f6b:7078:b3df]:32672","distributed":false}
{"level":"debug","ts":1766020087.2096343,"logger":"events","msg":"event","name":"tls_get_certificate","id":"c46da7fa-0798-43ef-b0ef-85f8a449cc99","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":["acme-tls/1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2a05:d016:39f:3102:3b39:d1be:b29c:e928","Port":64860,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"info","ts":1766020087.2097418,"logger":"tls","msg":"served key authentication certificate","server_name":"other-caddy-ssl.ttdi.us","challenge":"tls-alpn-01","remote":"[2a05:d016:39f:3102:3b39:d1be:b29c:e928]:64860","distributed":false}
{"level":"debug","ts":1766020087.3572936,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["831"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:07 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["3ZGp365BQopsWzXnCILrxQPLS-11pvxnH8_6l7JpkE55aws2Ie4"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020087.6096358,"logger":"events","msg":"event","name":"tls_get_certificate","id":"2a507e75-b2d5-4655-b745-5860743f8192","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539],"SupportedProtos":["acme-tls/1"],"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2406:da18:85:1400:9f8a:9abb:50aa:b86c","Port":61058,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"info","ts":1766020087.6096911,"logger":"tls","msg":"served key authentication certificate","server_name":"other-caddy-ssl.ttdi.us","challenge":"tls-alpn-01","remote":"[2406:da18:85:1400:9f8a:9abb:50aa:b86c]:61058","distributed":false}
{"level":"debug","ts":1766020087.6686096,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["831"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:07 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["3ZGp365BoEfgAOIND1KuLazJPjQNEXoQRsq2rj4CNxjDKiw9O58"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020087.9798207,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["831"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:07 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["3ZGp365BNBofVAfaD4m09GR4a901nHzlJYTxRAo1e1c4h2ErIXc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020088.2912545,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2888069156/629084642316","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["739"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["3ZGp365BCmrQ20JzkzJrPCSJwbUmyfgk6OziE8T9XUq9rr24hSk"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1766020088.2915246,"msg":"authorization finalized","identifier":"other-caddy-ssl.ttdi.us","authz_status":"valid"}
{"level":"info","ts":1766020088.2915516,"msg":"validations succeeded; finalizing order","order":"https://acme-v02.api.letsencrypt.org/acme/order/2888069156/459931559606"}
{"level":"debug","ts":1766020088.6860232,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/finalize/2888069156/459931559606","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2888069156"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["459"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-v02.api.letsencrypt.org/acme/order/2888069156/459931559606"],"Replay-Nonce":["WDq8UPGS1CkxI0S_q3F1reZvBb_19LHY4aNt9lOK8L6KcqYzNlA"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020088.7481337,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["2881"],"Content-Type":["application/pem-certificate-chain"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d/1>;rel=\"alternate\""],"Replay-Nonce":["3ZGp365B4n_lAZxT1LWrQt53RQSFMpdSdAw3YxYd2K-CdDbTQdc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020088.7483492,"msg":"getting renewal info","names":["other-caddy-ssl.ttdi.us"]}
{"level":"debug","ts":1766020088.8095505,"msg":"http request","method":"GET","url":"https://acme-v02.api.letsencrypt.org/acme/renewal-info/jw0TovYuftFQbDMYOF1ZjiNykco.Bf5HTupB1jHd3o5QVg6gnpxN","headers":{"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["101"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Retry-After":["21600"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1766020088.809734,"msg":"got renewal info","names":["other-caddy-ssl.ttdi.us"],"window_start":1771124022,"window_end":1771279471,"selected_time":1771198219,"recheck_after":1766041688.809724,"explanation_url":""}
{"level":"debug","ts":1766020088.8697035,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d/1","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["2316"],"Content-Type":["application/pem-certificate-chain"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d/0>;rel=\"alternate\""],"Replay-Nonce":["3ZGp365BE7HJlLtT5w_ISyiYKvKsX3mgCgYc3_NkElD0UxVAChQ"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1766020088.8705277,"msg":"getting renewal info","names":["other-caddy-ssl.ttdi.us"]}
{"level":"debug","ts":1766020088.9470026,"msg":"http request","method":"GET","url":"https://acme-v02.api.letsencrypt.org/acme/renewal-info/jw0TovYuftFQbDMYOF1ZjiNykco.Bf5HTupB1jHd3o5QVg6gnpxN","headers":{"User-Agent":["Caddy/2.10.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["101"],"Content-Type":["application/json"],"Date":["Thu, 18 Dec 2025 01:08:08 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Retry-After":["21600"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1766020088.9471385,"msg":"got renewal info","names":["other-caddy-ssl.ttdi.us"],"window_start":1771124022,"window_end":1771279471,"selected_time":1771236260,"recheck_after":1766041688.9471285,"explanation_url":""}
{"level":"info","ts":1766020088.9471908,"msg":"successfully downloaded available certificate chains","count":2,"first_url":"https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d"}
{"level":"debug","ts":1766020088.9472053,"logger":"http","msg":"selected certificate chain","url":"https://acme-v02.api.letsencrypt.org/acme/cert/05fe474eea41d631ddde8e50560ea09e9c4d"}
{"level":"info","ts":1766020088.9530954,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"other-caddy-ssl.ttdi.us","issuer":"acme-v02.api.letsencrypt.org-directory"}
{"level":"debug","ts":1766020088.9536948,"logger":"events","msg":"event","name":"cert_obtained","id":"248b9b4d-2710-40f8-9c98-228a9e46ff56","origin":"tls","data":{"certificate_path":"certificates/acme-v02.api.letsencrypt.org-directory/other-caddy-ssl.ttdi.us/other-caddy-ssl.ttdi.us.crt","csr_pem":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlIeE1JR1hBZ0VBTUFBd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFSV0MzdFVxVTh5YzMrVwo2clkrRVpRUUJuRTVOSzFmT0NUTjd5NENrNTROVzlPTjM0S0tiTGRpU1gzNU9IRUpDVEo4K3FBSkVzaUZPUjhVCjEwWFJ3dzhJb0RVd013WUpLb1pJaHZjTkFRa09NU1l3SkRBaUJnTlZIUkVFR3pBWmdoZHZkR2hsY2kxallXUmsKZVMxemMyd3VkSFJrYVM1MWN6QUtCZ2dxaGtqT1BRUURBZ05KQURCR0FpRUF5Rnl1bmNYYlJaTVliNUVnSlBvaQp4ZVc2MVFsL0hMWlEvdmxId212c3hISUNJUUQwYnEvMGVsSyt1V0VQUWRYbnVUQ0k2TE5rdjk3clFadURJSHVOCkFDQXNnQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFIFJFUVVFU1QtLS0tLQo=","identifier":"other-caddy-ssl.ttdi.us","issuer":"acme-v02.api.letsencrypt.org-directory","metadata_path":"certificates/acme-v02.api.letsencrypt.org-directory/other-caddy-ssl.ttdi.us/other-caddy-ssl.ttdi.us.json","private_key_path":"certificates/acme-v02.api.letsencrypt.org-directory/other-caddy-ssl.ttdi.us/other-caddy-ssl.ttdi.us.key","renewal":false,"storage_path":"certificates/acme-v02.api.letsencrypt.org-directory/other-caddy-ssl.ttdi.us"}}
{"level":"info","ts":1766020088.9540212,"logger":"tls.obtain","msg":"releasing lock","identifier":"other-caddy-ssl.ttdi.us"}
{"level":"debug","ts":1766020088.955239,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [other-caddy-ssl.ttdi.us]: no OCSP server specified in certificate","identifiers":["other-caddy-ssl.ttdi.us"]}
{"level":"debug","ts":1766020088.9555247,"logger":"tls.cache","msg":"added certificate to cache","subjects":["other-caddy-ssl.ttdi.us"],"expiration":1773792578,"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e","cache_size":2,"cache_capacity":10000}
{"level":"debug","ts":1766020088.9555683,"logger":"events","msg":"event","name":"cached_managed_cert","id":"249cf934-e68a-4e84-a86c-4ada271e3025","origin":"tls","data":{"sans":["other-caddy-ssl.ttdi.us"]}}
{"level":"debug","ts":1766020089.8653126,"logger":"events","msg":"event","name":"tls_get_certificate","id":"a204d327-6f9a-4677-a312-f124f4c607bb","origin":"tls","data":{"client_hello":{"CipherSuites":[35466,4865,4866,4867,49195,49199,49196,49200,52393,52392,49171,49172,156,157,47,53],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[10794,4588,29,23,24],"SupportedPoints":"AA==","SignatureSchemes":[1027,2052,1025,1283,2053,1281,2054,1537],"SupportedProtos":["h2","http/1.1"],"SupportedVersions":[35466,772,771],"RemoteAddr":{"IP":"2601:189:8580:c871:2d16:cee6:62ae:ae50","Port":64499,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"debug","ts":1766020089.8654006,"logger":"tls.handshake","msg":"choosing certificate","identifier":"other-caddy-ssl.ttdi.us","num_choices":1}
{"level":"debug","ts":1766020089.86541,"logger":"tls.handshake","msg":"default certificate selection results","identifier":"other-caddy-ssl.ttdi.us","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
{"level":"debug","ts":1766020089.8654187,"logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"2601:189:8580:c871:2d16:cee6:62ae:ae50","remote_port":"64499","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"expiration":1773792578,"hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
{"level":"debug","ts":1766020090.0788321,"logger":"events","msg":"event","name":"tls_get_certificate","id":"741012a6-ab59-4f47-b292-0761dbd3d575","origin":"tls","data":{"client_hello":{"CipherSuites":[4865,4866,4867],"ServerName":"caddy-ssl-test.ttdi.us","SupportedCurves":[4588,29,23,24],"SupportedPoints":null,"SignatureSchemes":[1027,2052,1025,1283,2053,1281,2054,1537,513],"SupportedProtos":["h3"],"SupportedVersions":[772],"RemoteAddr":{"IP":"2601:189:8580:c871:2d16:cee6:62ae:ae50","Port":65076,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"debug","ts":1766020090.0792084,"logger":"tls.handshake","msg":"choosing certificate","identifier":"caddy-ssl-test.ttdi.us","num_choices":1}
{"level":"debug","ts":1766020090.079224,"logger":"tls.handshake","msg":"default certificate selection results","identifier":"caddy-ssl-test.ttdi.us","subjects":["caddy-ssl-test.ttdi.us","*.caddy-ssl-test.ttdi.us"],"managed":false,"issuer_key":"","hash":"b5aec2f7eda574fd204f67e78611f523e7813672e224f5c55d51618488363bab"}
{"level":"debug","ts":1766020090.0792322,"logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"2601:189:8580:c871:2d16:cee6:62ae:ae50","remote_port":"65076","subjects":["caddy-ssl-test.ttdi.us","*.caddy-ssl-test.ttdi.us"],"managed":false,"expiration":1773639395,"hash":"b5aec2f7eda574fd204f67e78611f523e7813672e224f5c55d51618488363bab"}
{"level":"debug","ts":1766020151.9550397,"logger":"events","msg":"event","name":"tls_get_certificate","id":"da099abd-8977-41ec-b669-cfc81e936136","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539,513,515],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"64.23.218.208","Port":35748,"Zone":""},"LocalAddr":{"IP":"159.223.159.15","Port":443,"Zone":""}}}}
{"level":"debug","ts":1766020151.9551363,"logger":"tls.handshake","msg":"choosing certificate","identifier":"other-caddy-ssl.ttdi.us","num_choices":1}
{"level":"debug","ts":1766020151.9551466,"logger":"tls.handshake","msg":"default certificate selection results","identifier":"other-caddy-ssl.ttdi.us","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
{"level":"debug","ts":1766020151.9551578,"logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"64.23.218.208","remote_port":"35748","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"expiration":1773792578,"hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
{"level":"debug","ts":1766020152.0445824,"logger":"events","msg":"event","name":"tls_get_certificate","id":"670f7143-4c84-488a-8f43-d7fdd3c9f01a","origin":"tls","data":{"client_hello":{"CipherSuites":[49195,49199,49196,49200,52393,52392,49161,49171,49162,49172,4865,4866,4867],"ServerName":"other-caddy-ssl.ttdi.us","SupportedCurves":[4588,29,23,24,25],"SupportedPoints":"AA==","SignatureSchemes":[2052,1027,2055,2053,2054,1025,1281,1537,1283,1539,513,515],"SupportedProtos":null,"SupportedVersions":[772,771],"RemoteAddr":{"IP":"2a03:b0c0:3:d0::e89:e001","Port":54482,"Zone":""},"LocalAddr":{"IP":"2604:a880:400:d1:0:3:6578:e001","Port":443,"Zone":""}}}}
{"level":"debug","ts":1766020152.0448966,"logger":"tls.handshake","msg":"choosing certificate","identifier":"other-caddy-ssl.ttdi.us","num_choices":1}
{"level":"debug","ts":1766020152.0449173,"logger":"tls.handshake","msg":"default certificate selection results","identifier":"other-caddy-ssl.ttdi.us","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
{"level":"debug","ts":1766020152.0451932,"logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"2a03:b0c0:3:d0::e89:e001","remote_port":"54482","subjects":["other-caddy-ssl.ttdi.us"],"managed":true,"expiration":1773792578,"hash":"cb5dfc03a34c1f1f9914c13ccc2326528bdf172c319744e08e4e3f69cac52e7e"}
I think it’s most correct to specify your hostnames like you did with