Probably can't retrieve certificate due to rootless docker?

Why do you need to bind port 80 on the host machine to port 8080 in the container? I’m not sure if you mean to do it this way due to a misunderstanding or something. Anyway, if Caddy is obtaining the certificate through port 8080 in the container as you’ve configured with your Caddyfile, your configuration means Caddy still doesn’t know that it’s supposed to listen on port 8443 in the container for serving HTTPS instead of 443. You would need to modify the http_port and https_port global option.

{
    http_port 8080
    https_port 8443
}

sub.domain.de {
    reverse_proxy n8n:5678 {
      flush_interval -1
    }


    tls {
        issuer acme {
            alt_http_port 8080
            alt_tlsalpn_port 8443
        }
    }
}