1. The problem I’m having:
We deploy our application with pm2 and use caddy as a reverse proxy. We recieved a self-signed certificate from the customer in a pfx format. I exported the client and private key with these commands:
openssl pkcs12 -in file.pfx -nocerts -out private.key -nodes
openssl pkcs12 -in file.pfx -clcerts -nokeys -out certificate.crt
(I later also exported the CA with openssl pkcs12 -in file.pfx -cacerts -nokeys -chain | openssl x509 -out cacerts.crt and added them with the ca_root module (tried ca module as well))
When running caddy the website returns with a “Not secure” warning everytime. I know that the pfx is legit, as we use it for a windows server, which is displaying the proper secure connection.
This setup has worked for other customers, the difference is that this customer user is usign a self-signed certificate rather than a paid-for one.
I have also tried the pfx caddy plugin which didn’t make a difference.
We are running caddy with docker compose. I tried running caddy bare metal but got the same issues. I also tried installing the ca certificate with sudo update-ca-certificates (I’m trying everything at this point).
2. Error messages and/or full log output:
{"level":"info","ts":1729596544.6084354,"msg":"using config from file","file":"/etc/caddy/Caddyfile"}
{"level":"info","ts":1729596544.608952,"msg":"adapted config to JSON","adapter":"caddyfile"}
{"level":"info","ts":1729596544.6093082,"logger":"admin","msg":"admin endpoint started","address":"localhost:2019","enforce_origin":false,"origins":["//127.0.0.1:2019","//localhost:2019","//[::1]:2019"]}
{"level":"info","ts":1729596544.6094074,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00044f580"}
{"level":"warn","ts":1729596544.6095397,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [A1.domain.local A2.domain.local A3.domain.local]: no OCSP server specified in certificate"}
{"level":"info","ts":1729596544.6095731,"logger":"http.auto_https","msg":"skipping automatic certificate management because one or more matching certificates are already loaded","domain":"A1.domain.local","server_name":"srv0"}
{"level":"info","ts":1729596544.6095772,"logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"info","ts":1729596544.6096992,"logger":"http","msg":"enabling HTTP/3 listener","addr":":443"}
{"level":"info","ts":1729596544.6097817,"logger":"http.log","msg":"server running","name":"srv0","protocols":["h1","h2","h3"]}
{"level":"info","ts":1729596544.6097968,"logger":"http.log","msg":"server running","name":"remaining_auto_https_redirects","protocols":["h1","h2","h3"]}
{"level":"info","ts":1729596544.6098483,"msg":"autosaved config (load with --resume flag)","file":"/config/caddy/autosave.json"}{"level":"info","ts":1729596544.6098523,"msg":"serving initial configuration"}
{"level":"info","ts":1729596544.6105423,"logger":"tls","msg":"cleaning storage unit","storage":"FileStorage:/data/caddy"}
{"level":"info","ts":1729596544.6106112,"logger":"tls","msg":"finished cleaning storage units"}
3. Caddy version:
caddy:2.8.4-alpine
4. How I installed and ran Caddy:
Inside docker compose
a. System environment:
Debian 12.7
Docker 27.3.1
b. Command:
docker compose up -d
c. Service/unit/compose file:
services:
caddy:
image: caddy:2.8.4-alpine
restart: always
cap_add:
- NET_ADMIN
ports:
- "80:80"
- "443:443"
- "443:443/udp"
network_mode: host
extra_hosts:
- host.docker.internal:host-gateway
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile
- caddy_data:/data
- caddy_config:/config
- ./ssl/:/etc/ssl/certs/
- ./private/:/etc/ssl/private/
volumes:
caddy_data:
caddy_config:
d. My complete Caddy config:
A1.domain.local {
tls /etc/ssl/certs/client.crt /etc/ssl/private/private.key
reverse_proxy localhost:3000
}
I also tried
A1.domain.local {
tls /etc/ssl/certs/client.crt /etc/ssl/private/private.key {
ca_root /etc/ssl/certs/ca.crt
}
reverse_proxy localhost:3000
}