1. The problem I’m having:
When I make a https request to a subdomain I get a tls error. When I review the logs I get “no certificates found.” Other than journalct -xfvu caddy not sure where else to look for information. Is there a location where the certs would be stored to see if they are there?
2. Error messages and/or full log output:
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"info","ts":1739401976.2252278,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0008e4100"}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"info","ts":1739401976.2273462,"msg":"serving initial configuration"}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"info","ts":1739401976.2284348,"logger":"tls","msg":"storage cleaning happened too recently; skipping for now","storage":"FileStorage:/var/lib/caddy/.local/share/caddy","instance":"1b0e2d2e-a23a-4833-a78f-f1d033ee8e5b","try_again":1739488376.2284322,"try_again_in":86399.99999903}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"info","ts":1739401976.2293382,"logger":"tls","msg":"finished cleaning storage units"}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"debug","ts":1739401976.4420645,"logger":"events","msg":"event","name":"tls_get_certificate","id":"d09baa61-9521-4444-858b-b15af949957e","origin":"tls","data":{"client_hello":{"CipherSuites":[64250,4865,4866,4867,49195,49199,49196,49200,52393,52392,49171,49172,156,157,47,53],"ServerName":"www.foundryserver.ca","SupportedCurves":[60138,4588,29,23,24],"SupportedPoints":"AA==","SignatureSchemes":[1027,2052,1025,1283,2053,1281,2054,1537],"SupportedProtos":["h2","http/1.1"],"SupportedVersions":[6682,772,771],"RemoteAddr":{"IP":"70.66.209.81","Port":65204,"Zone":""},"LocalAddr":{"IP":"192.168.255.242","Port":8443,"Zone":""}}}}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"debug","ts":1739401976.4429224,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"www.foundryserver.ca"}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"debug","ts":1739401976.4431572,"logger":"tls.handshake","msg":"choosing certificate","identifier":"*.foundryserver.ca","num_choices":1}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"debug","ts":1739401976.4433582,"logger":"tls.handshake","msg":"default certificate selection results","identifier":"*.foundryserver.ca","subjects":["*.foundryserver.ca"],"managed":true,"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"3d483229b90ac5d6a40751d831e3b5c6ccc629d8474a57c53ab1e6aa24b90822"}
Feb 12 15:12:56 caddy1 caddy[49126]: {"level":"debug","ts":1739401976.4435668,"logger":"tls.handshake","msg":"matched certificate in cache","remote_ip":"70.66.209.81","remote_port":"65204","subjects":["*.foundryserver.ca"],"managed":true,"expiration":1747172068,"hash":"3d483229b90ac5d6a40751d831e3b5c6ccc629d8474a57c53ab1e6aa24b90822"}
F
3. Caddy version:
v2.9.1 h1:OEYiZ7DbCzAWVb6TNEkjRcSCRGHVoZsJinoDR/n9oaY=
4. How I installed and ran Caddy:
I used apt via the caddy documentation for debian
a. System environment:
Linux caddy1 6.1.0-31-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.128-1 (2025-02-07) x86_64 GNU/Linux
Systemd
b. Command:
systemctl start caddy
c. Service/unit/compose file:
Default systemd file, no changes.
d. My complete Caddy config:
{
debug
http_port 8080
https_port 8443
metrics
admin 0.0.0.0:4334
email admin@foundryserver.com
}
# Domain specific server blocks
*.foundryserver.ca {
tls {
dns cloudflare {redacted}
}
# customer routes
map {host}:8080 {backend_ip} {
joe.foundryserver.ca "192.168.255.200"
}
reverse_proxy {host}:8080 {backend_ip}:30000 {
# values for websocket connection
stream_close_delay 8h
}
# all other routes that don't match the customer routes.
reverse_proxy *.foundryserver.ca:8080 172.168.10.10:80
handle_errors 5xx {
# This is used to catch a request for a customer game server that is not running.
# This will NOT catch an unknown user subdomain.
root * /var/www/error_pages/5xx_error.html
file_server
}
}