PowerDNS plugin

[francislavoie]

@lecris

Yes I sort of remembered that point. Is it possible to expose this acme server for other applications?

Yep! That’s exactly why it’s available as a http handler!

@lecris

Create and manage tls certificates for mail server IMAP/POP3/SMTP ports. Either with a certbot or dns challenge

Caddy completely replaces certbot. Caddy itself is an ACME client, and it’s the underlying function of its flagship feature, Automatic HTTPS:

Automatic HTTPS - Caddy Documentation

Caddy is primarily an HTTP server, and the Caddyfile adapter aims to fill that niche, so it’s better to use JSON config if you need to manage non-HTTP domains. See this article for an example:

Using Caddy to keep certificates renewed

You can use Caddy as an automated certificate manager to keep certificates renewed without having to run an HTTPS server [1]. This way, the certificates can be used by other programs that need them. Caddy’s tls app can be configured without the need for an HTTP server. It can keep certificates renewed. Without additional configuration, assets (certificates, keys, and metadata) are stored in a data directory on the local file system at a location dependent upon your OS. The simplest form is to …

@lecris

Manage multiple CAs, e.g. public let’s encrypt for https, private one for client certificates, etc.

Yeah, you can configure multiple issuers. By default, Caddy enables the acme issuer (for Let’s Encrypt) and the zerossl issuer (for ZeroSSL – which is also ACME, but it came later so the names aren’t aligned). There’s also the internal issuer which is your local CA.

@lecris

Create and access control client certificates for a particular domain. I don’t yet understand if this has to be managed by the CA, mail server or another service

Yep, see the tls directive, which allows you to configure client_auth:

tls (Caddyfile directive) - Caddy Documentation

@lecris

Does caddy use certbot internally or with a plugin?

Nope, Caddy uses acmez which is its own ACME client implementation. This is because Caddy needs to have greater control over its underlying ACME client implementation so it can be more rigorous and reliable. Caddy used to use lego, another Let’s Encrypt client lib, but it wasn’t enough to support everything Caddy needed to do, and it was too rigid to change for Caddy (because it’s used by other users who have different goals in mind).