Wildcard certificates for on demand setup

timelordx · December 18, 2025, 10:32pm

This might be related to your question:

github.com/caddyserver/caddy

On demand TLS with no host matcher (or multiple wildcards)

opened 09:37PM - 13 Aug 24 UTC

closed 05:15PM - 14 Aug 24 UTC

alexdavid

question

We have a Caddy configuration that is used for TLS termination via on demand cer…tificate generation. This seems to work fine when there is a host matcher in place with at most one wildcard subdomain. However, removing the host matcher or adding additional wildcards to the host matcher cause the on demand certificate generation to fall back to a local issuer rather than Let's Encrypt. We are using Caddy as a reverse proxy in front of customer domains that are of the form of `<name>.<name>.example.org` so we cannot easily know these domains ahead of time. We have a `on_demand.ask` rule in place to ensure that certificates are only generated for valid customers. To be clear: we know that Let's Encrypt doesn't support double wildcard certificates, but since on demand is enabled the certificates shouldn't be wildcard anyway. Is it possible to just use purely SNI + `on_demand.ask` rather than needing to use the host matcher at all? I can't find any documentation describing the interaction between on demand certificate generation and host matchers.