1. The problem I’m having:
I’m using NextDNS (via Tailscale) to configure a rewrite for *.localhost.internal → my MacBook’s Tailscale IP address. When I query a NextDNS endpoint to check the records, I see an A record for it.
Is there a way to configure Caddy, Lets Encrypt, or some other CA to use a custom DNS resolver so they see the A record?
2. Error messages and/or full log output:
2024/12/21 22:53:41.546 INFO using adjacent Caddyfile
2024/12/21 22:53:41.548 INFO adapted config to JSON {"adapter": "caddyfile"}
2024/12/21 22:53:41.548 WARN Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies {"adapter": "caddyfile", "file": "Caddyfile", "line": 2}
2024/12/21 22:53:41.550 INFO admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//127.0.0.1:2019", "//localhost:2019", "//[::1]:2019"]}
2024/12/21 22:53:41.550 INFO http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "srv0", "https_port": 443}
2024/12/21 22:53:41.551 INFO http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "srv0"}
2024/12/21 22:53:41.551 DEBUG http.auto_https adjusted config {"tls": {"automation":{"policies":[{"subjects":["localhost.internal"]},{}]}}, "http": {"servers":{"remaining_auto_https_redirects":{"listen":[":80"],"routes":[{},{}]},"srv0":{"listen":[":443"],"routes":[{"handle":[{"handler":"subroute","routes":[{"handle":[{"body":"hello world","handler":"static_response"}]}]}],"terminal":true}],"tls_connection_policies":[{}],"automatic_https":{}}}}}
2024/12/21 22:53:41.552 INFO http enabling HTTP/3 listener {"addr": ":443"}
2024/12/21 22:53:41.553 DEBUG http starting server loop {"address": "[::]:443", "tls": true, "http3": true}
2024/12/21 22:53:41.553 INFO http.log server running {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2024/12/21 22:53:41.553 DEBUG http starting server loop {"address": "[::]:80", "tls": false, "http3": false}
2024/12/21 22:53:41.554 INFO http.log server running {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2024/12/21 22:53:41.554 INFO http enabling automatic TLS certificate management {"domains": ["localhost.internal"]}
2024/12/21 22:53:41.555 INFO autosaved config (load with --resume flag) {"file": "/root/.config/caddy/autosave.json"}
2024/12/21 22:53:41.555 INFO serving initial configuration
2024/12/21 22:53:41.557 INFO tls.obtain acquiring lock {"identifier": "localhost.internal"}
2024/12/21 22:53:41.561 INFO tls.obtain lock acquired {"identifier": "localhost.internal"}
2024/12/21 22:53:41.563 INFO tls.obtain obtaining certificate {"identifier": "localhost.internal"}
2024/12/21 22:53:41.564 DEBUG events event {"name": "cert_obtaining", "id": "93fff3c1-2059-4f81-9d99-c44c31e8bb2f", "origin": "tls", "data": {"identifier":"localhost.internal"}}
2024/12/21 22:53:41.565 DEBUG tls.obtain trying issuer 1/1 {"issuer": "acme-staging-v02.api.letsencrypt.org-directory"}
2024/12/21 22:53:41.565 INFO tls.issuance.acme waiting on internal rate limiter {"identifiers": ["localhost.internal"], "ca": "https://acme-staging-v02.api.letsencrypt.org/directory", "account": ""}
2024/12/21 22:53:41.566 INFO tls.issuance.acme done waiting on internal rate limiter {"identifiers": ["localhost.internal"], "ca": "https://acme-staging-v02.api.letsencrypt.org/directory", "account": ""}
2024/12/21 22:53:41.566 INFO tls.issuance.acme using ACME account {"account_id": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/177129554", "account_contact": []}
2024/12/21 22:53:41.568 INFO tls.cache.maintenance started background certificate maintenance {"cache": "0xc0000ef480"}
2024/12/21 22:53:41.572 INFO tls storage cleaning happened too recently; skipping for now {"storage": "FileStorage:/root/.local/share/caddy", "instance": "8d56a6de-9e8b-4064-9c3b-a597ae4caa72", "try_again": "2024/12/22 22:53:41.572", "try_again_in": 86399.999998658}
2024/12/21 22:53:41.573 INFO tls finished cleaning storage units
2024/12/21 22:53:41.746 DEBUG tls.issuance.acme.acme_client http request {"method": "GET", "url": "https://acme-staging-v02.api.letsencrypt.org/directory", "headers": {"User-Agent":["Caddy/2.8.4 CertMagic acmez (linux; amd64)"]}, "response_headers": {"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["820"],"Content-Type":["application/json"],"Date":["Sat, 21 Dec 2024 22:53:41 GMT"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]}, "status_code": 200}
2024/12/21 22:53:41.746 DEBUG tls.issuance.acme.acme_client creating order {"account": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/177129554", "identifiers": ["localhost.internal"]}
2024/12/21 22:53:41.799 DEBUG tls.issuance.acme.acme_client http request {"method": "HEAD", "url": "https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce", "headers": {"User-Agent":["Caddy/2.8.4 CertMagic acmez (linux; amd64)"]}, "response_headers": {"Cache-Control":["public, max-age=0, no-cache"],"Date":["Sat, 21 Dec 2024 22:53:41 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["NqoFGPoyW5z0aF9F6uFrCahB-yzEXxmi8_1WtysXl9pK0lY1oFY"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]}, "status_code": 200}
2024/12/21 22:53:41.856 DEBUG tls.issuance.acme.acme_client http request {"method": "POST", "url": "https://acme-staging-v02.api.letsencrypt.org/acme/new-order", "headers": {"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.8.4 CertMagic acmez (linux; amd64)"]}, "response_headers": {"Boulder-Requester":["177129554"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["225"],"Content-Type":["application/problem+json"],"Date":["Sat, 21 Dec 2024 22:53:41 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["NqoFGPoyDcG4XdNfEtPHFqDCZNciExHXu0apxXKLan3_DQgtynY"],"Server":["nginx"]}, "status_code": 400}
2024/12/21 22:53:41.856 ERROR tls.obtain could not get certificate from issuer {"identifier": "localhost.internal", "issuer": "acme-staging-v02.api.letsencrypt.org-directory", "error": "HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid identifiers requested :: Cannot issue for \"localhost.internal\": Domain name does not end with a valid public suffix (TLD)"}
2024/12/21 22:53:41.856 DEBUG events event {"name": "cert_failed", "id": "3eca5d04-5ff7-43bc-9cf1-f34b10f7847c", "origin": "tls", "data": {"error":{},"identifier":"localhost.internal","issuers":["acme-staging-v02.api.letsencrypt.org-directory"],"renewal":false}}
2024/12/21 22:53:41.856 ERROR tls.obtain will retry {"error": "[localhost.internal] Obtain: [localhost.internal] creating new order: attempt 1: https://acme-staging-v02.api.letsencrypt.org/acme/new-order: HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid identifiers requested :: Cannot issue for \"localhost.internal\": Domain name does not end with a valid public suffix (TLD) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)", "attempt": 1, "retrying_in": 60, "elapsed": 0.29466728, "max_duration": 2592000}
^C2024/12/21 22:53:43.135 INFO shutting down {"signal": "SIGINT"}
2024/12/21 22:53:43.135 WARN exiting; byeee!! 👋 {"signal": "SIGINT"}
2024/12/21 22:53:43.135 INFO http servers shutting down with eternal grace period
2024/12/21 22:53:43.136 INFO admin stopped previous server {"address": "localhost:2019"}
2024/12/21 22:53:43.136 INFO shutdown complete {"signal": "SIGINT", "exit_code": 0}
3. Caddy version:
v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
4. How I installed and ran Caddy:
a. System environment:
Debian 12 amd64
b. Command:
caddy run
d. My complete Caddy config:
{
acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
debug
}
localhost.internal {
respond "test"
}