Multi Issuers and fallback ordering

[matt (Matt Holt)]

This was just asked:

Question about the Multi-Issuer Support

Welcome! Technically, if you only want to allow Let’s Encrypt (or any other specific CAs) to issue certs for your domains, you need to configure CAA records in your DNS zone. This is unrelated to Caddy, and it sounds like what your applications actually require based on what you’ve said. If you want to configure the issuers that Caddy uses, the existing methods apply. Since you mentioned that you set cert_issuer I assume you’re using the Caddyfile: cert_issuer global option or tls directive …

Configuring multiple issuers is the same as before when you only configured one, except that you can now have more than one. (This PR has an example: caddytls: Support multiple issuers by mholt · Pull Request #3862 · caddyserver/caddy · GitHub)

Our wiki article explains multiple ways to configure ZeroSSL:

Using ZeroSSL's ACME endpoint

ZeroSSL is an ACME-compatible certificate authority alternative to Let’s Encrypt. ZeroSSL’s ACME endpoint is already compatible with Caddy because it implements RFC 8555. But Caddy 2.2 has more convenient support for ZeroSSL because it will automatically generate the necessary External Account Binding (EAB) credentials for you. As of Caddy 2.2, there are several ways to use ZeroSSL. I’ll demonstrate the Caddyfile config, but you can use caddy adapt to get the equivalent JSON. Using global op…

@Hendrik_Visage

Also, it seems whenever you select the issuers/cert_issuer, you have to specify an API key for ZeroSSL

An API key is not required. The syntax indicates it is optional: tls (Caddyfile directive) — Caddy Documentation

The many linked resources should help you out, including the syntax for configuring issuers (I assume you’re using the Caddyfile; if not, you can find similar help in our JSON structure docs).

@Hendrik_Visage

how would I go about to configure let’s say: BuyPass, then ZeroSSL and then LE for fallback?

Something like this:

tls {
    issuer acme {
        dir https://api.buypass.com/acme/directory
    }
    issuer zerossl  # could alternatively use "issuer acme ..." with ZeroSSL directory endpoint
    issuer acme # current default is LE; hard-code dir endpoint to force that
}

In an upcoming patch release (probably) you’ll be able to roll that first one into a single line: issuer acme https://api.buypass.com/acme/directory.