I want to access jellyfin from remote by adding caddy as reverse proxy on a raspberry PI4 with raspberryOS 64bit lite. I don’t get the certificate, when running caddy. See logs
2. Error messages and/or full log output:
`
Jan 19 17:13:09 xxxxx caddy[829]: {“level”:“error”,“ts”:1768839189.8486156,“logger”:“tls.obtain”,“msg”:“could not get certificate from issuer”,“identifier”:“xxxxx.ddns.net”,“issuer”:“acme-v02.api.letsencrypt.org-directory”,“error”:“HTTP 400 urn:ietf:params:acme:error:connection - 92.116.66.18: Fetching http://xxxxx.ddns.net/.well-known/acme-challenge/SUyR4Tek4Pgjs6dXAsz3D1HE5qVIvSsRRvzY9moefNc: Error getting validation data”}Jan 19 17:13:09 xxxxx caddy[829]: {“level”:“error”,“ts”:1768839189.8487456,“logger”:“tls.obtain”,“msg”:“will retry”,“error”:“[xxxxx.ddns.net] Obtain: [xxxxx.ddns.net] solving challenge: xxxxx.ddns.net: [xxxxx.ddns.net] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - 92.116.66.18: Fetching http://xxxxx.ddns.net/.well-known/acme-challenge/SUyR4Tek4Pgjs6dXAsz3D1HE5qVIvSsRRvzY9moefNc: Error getting validation data (ca=https://acme-staging-v02.api.letsencrypt.org/directory)”,“attempt”:3,“retrying_in”:120,“elapsed”:189.998216537,“max_duration”:2592000}
`
# The Caddyfile is an easy way to configure your Caddy web server.
#
# Unless the file starts with a global options block, the first
# uncommented line is always the address of your site.
#
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace ":80" below with your
# domain name.
{
admin :2020
}
#:80 {
# Set this path to your site's directory.
# root * /usr/share/caddy
# Enable the static file server.
# file_server
# Another common task is to set up a reverse proxy:
# reverse_proxy localhost:8080
# Or serve a PHP site through php-fpm:
# php_fastcgi localhost:9000
#}
# Refer to the Caddy docs for more information:
# https://caddyserver.com/docs/caddyfile
xxxxx.ddns.net {
# Reverse proxy to Jellyfin's internal address and port
reverse_proxy 127.0.0.1:8096
# Optional: Redirect HTTP to HTTPS (Caddy does this automatically)
# header Strict-Transport-Security max-age=31536000;
# Optional: Enable compression for faster streaming
# encode gzip zstd
# Optional: Set a custom port if needed (e.g., 443 for standard HTTPS)
# tls {
# protocols tls1.2 tls1.3
# }
}
The second error you are seeing (HTTP 503 … Service busy) is likely a temporary issue with the Let’s Encrypt Staging environment or a result of too many retries. It usually resolves itself if you wait a bit.
However, the first log shows the real problem that needs to be fixed:
Error getting validation data … HTTP 400 urn:ietf:params:acme:error:connection
This means Let’s Encrypt attempted to connect to your Raspberry Pi on Port 80 to validate your domain, but the connection failed. Since you are running this at home with No-IP, this is usually caused by one of two things:
Port Forwarding: Have you logged into your home router and forwarded ports 80 and 443 to the internal IP address of your Raspberry Pi? Without this, traffic from the internet hits your router and stops there.
Firewall / ISP: Check if your Raspberry Pi’s firewall (ufw or iptables) allows incoming traffic on ports 80/443. Also, ensure your ISP allows you to open ports (some ISPs use CGNAT, which prevents port forwarding).
To test this: Try to access your domain from a device outside your home network (like your phone on 4G/5G). If you cannot load a page (even an empty one), Let’s Encrypt can’t reach you either.
So what do I have to do that caddy starts with sudo my configuration
xxxxx.ddns.net {
# Reverse proxy to Jellyfin's internal address and port
reverse_proxy 127.0.0.1:8096
# Optional: Redirect HTTP to HTTPS (Caddy does this automatically)
# header Strict-Transport-Security max-age=31536000;
# Optional: Enable compression for faster streaming
# encode gzip zstd
# Optional: Set a custom port if needed (e.g., 443 for standard HTTPS)
# tls {
# protocols tls1.2 tls1.3
# }
}
