1. The problem I’m having:
I’m trying to use the internal caddy tls features for local testing and development. However, the certificates issued by the internal PKI don’t have any subject set. I can’t find how to configure this subject (or I didn’t understand the docs):
2. Error messages and/or full log output:
2026/01/06 09:02:53.426 INFO maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined
2026/01/06 09:02:53.427 INFO GOMEMLIMIT is updated {"package": "github.com/KimMachineGun/automemlimit/memlimit", "GOMEMLIMIT": 13980837888, "previous": 9223372036854775807}
2026/01/06 09:02:53.427 INFO using config from file {"file": "conf/Caddyfile"}
2026/01/06 09:02:53.429 INFO adapted config to JSON {"adapter": "caddyfile"}
2026/01/06 09:02:53.429 WARN Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies {"adapter": "caddyfile", "file": "conf/Caddyfile", "line": 2}
2026/01/06 09:02:53.431 INFO admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//localhost:2019", "//[::1]:2019", "//127.0.0.1:2019"]}
2026/01/06 09:02:53.432 INFO tls.cache.maintenance started background certificate maintenance {"cache": "0xc0009ca300"}
2026/01/06 09:02:53.432 INFO http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "srv0"}
2026/01/06 09:02:53.433 INFO http enabling HTTP/3 listener {"addr": ":10443"}
2026/01/06 09:02:53.433 INFO failed to sufficiently increase receive buffer size (was: 208 kiB, wanted: 7168 kiB, got: 416 kiB). See https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes for details.
2026/01/06 09:02:53.433 INFO http.log server running {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2026/01/06 09:02:53.434 WARN http HTTP/2 skipped because it requires TLS {"network": "tcp", "addr": ":8099"}
2026/01/06 09:02:53.434 WARN http HTTP/3 skipped because it requires TLS {"network": "tcp", "addr": ":8099"}
2026/01/06 09:02:53.434 INFO http.log server running {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2026/01/06 09:02:53.434 INFO http enabling automatic TLS certificate management {"domains": ["mastodon.local"]}
2026/01/06 09:02:53.434 INFO pki.ca.local root certificate is already trusted by system {"path": "storage:pki/authorities/local/root.crt"}
2026/01/06 09:02:53.435 INFO autosaved config (load with --resume flag) {"file": "/home/ploeger/.config/caddy/autosave.json"}
2026/01/06 09:02:53.435 INFO serving initial configuration
2026/01/06 09:02:53.438 INFO tls cleaning storage unit {"storage": "FileStorage:/home/ploeger/.local/share/caddy"}
2026/01/06 09:02:53.440 INFO tls.obtain acquiring lock {"identifier": "mastodon.local"}
2026/01/06 09:02:53.442 INFO tls finished cleaning storage units
2026/01/06 09:02:53.443 INFO tls.obtain lock acquired {"identifier": "mastodon.local"}
2026/01/06 09:02:53.444 INFO tls.obtain obtaining certificate {"identifier": "mastodon.local"}
2026/01/06 09:02:53.452 INFO tls.obtain certificate obtained successfully {"identifier": "mastodon.local", "issuer": "local"}
2026/01/06 09:02:53.452 INFO tls.obtain releasing lock {"identifier": "mastodon.local"}
2026/01/06 09:02:53.453 WARN tls stapling OCSP {"identifiers": ["mastodon.local"]}
^C2026/01/06 09:03:45.561 INFO shutting down {"signal": "SIGINT"}
2026/01/06 09:03:45.561 WARN exiting; byeee!! 👋 {"signal": "SIGINT"}
2026/01/06 09:03:45.561 INFO http servers shutting down with eternal grace period
2026/01/06 09:03:45.562 INFO admin stopped previous server {"address": "localhost:2019"}
2026/01/06 09:03:45.562 INFO shutdown complete {"signal": "SIGINT", "exit_code": 0}
3. Caddy version:
v2.10.2 h1:g/gTYjGMD0dec+UgMw8SnfmJ3I9+M2TdvoRL/Ovu6U8=
4. How I installed and ran Caddy:
Downloaded Caddy from the website and ran:
caddy run --config conf/Caddyfile
a. System environment:
Linux AMD64, Bazzite OS
b. Command:
$ caddy run --config conf/Caddyfile
# mastodon.local is mapped to 127.0.0.1 in my hosts
$ openssl s_client -connect mastodon.local:10443 < /dev/null 2>&1 | grep subject
subject=
c. Service/unit/compose file:
None
d. My complete Caddy config:
{
http_port 8099
}
https://mastodon.local:10443
{
tls internal
reverse_proxy * {
to web:3000
}
}