1. The problem I’m having:
I’m trying to reverse proxy https://localhost to an internal LAN IP and port, so I ran this:
caddy reverse-proxy --from locahost:443 --to 192.168.0.1:5000 --internal-certs
And that starts up without any errors. If I then point firefox at https://localhost, I get an SSL_ERROR_INTERNAL_ERROR_ALERT error that is so hard there isn’t even the option to say “yes I know, ignore it, load anyway”, it’s just a hard nope.
2. Error messages and/or full log output:
C:\> caddy reverse-proxy --from locahost:443 --to 192.168.0.1:5000 --internal-certs
admin admin endpoint disabled
tls.cache.maintenance started background certificate maintenance {"cache": "0xc000151380"}
http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "proxy", "https_port": 443}
http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "proxy"}
pki.ca.local root certificate is already trusted by system {"path": "storage:pki/authorities/local/root.crt"}
http enabling HTTP/3 listener {"addr": ":443"}
http.log server running {"name": "proxy", "protocols": ["h1", "h2", "h3"]}
http HTTP/2 skipped because it requires TLS {"network": "tcp", "addr": ":80"}
http HTTP/3 skipped because it requires TLS {"network": "tcp", "addr": ":80"}
http.log server running {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
http enabling automatic TLS certificate management {"domains": ["locahost"]}
caddy proxying {"from": "https://locahost", "to": ["192.168.0.1:5000"]}
tls certificate is in configured renewal window based on expiration date {"subjects": ["locahost"], "expiration": "2026/01/30 16:18:12.000", "ari_cert_id": "", "next_ari_update": null, "renew_check_interval": 600, "window_start": "0001/01/01 00:00:00.000", "window_end": "0001/01/01 00:00:00.000", "remaining": -22820098.7608502}
tls storage cleaning happened too recently; skipping for now {"storage": "FileStorage:C:\\Users\\Mike\\AppData\\Roaming\\Caddy", "instance": "10ebf699-afa9-4257-bd44-15b2d408bb7a", "try_again": "2026/10/22 19:13:10.764", "try_again_in": 86400}
tls finished cleaning storage units
tls.renew acquiring lock {"identifier": "locahost"}
tls.renew lock acquired {"identifier": "locahost"}
tls.renew renewing certificate {"identifier": "locahost", "remaining": -22820098.7750625}
tls.renew certificate renewed successfully {"identifier": "locahost", "issuer": "local"}
tls.renew releasing lock {"identifier": "locahost"}
tls reloading managed certificate {"identifiers": ["locahost"]}
tls.cache replaced certificate in cache {"subjects": ["locahost"], "new_expiration": "2026/10/22 07:13:11.000"}
3. Caddy version:
v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=
4. How I installed and ran Caddy:
I have no idea how I originally installed Caddy, but the invocation’s in the above log.
a. System environment:
Windows 10 Pro x64, plain caddy in a plain command prompt.
b. Command:
caddy reverse-proxy --from locahost:443 --to 192.168.0.1:5000 --internal-certs
c. Service/unit/compose file:
n/a
d. My complete Caddy config:
n/a
5. Links to relevant resources:
n/a