Skip to main content
To get automatic HTTPS with Caddy, install it from Caddy’s official repository, write your domain into /etc/caddy/Caddyfile (for example example.com { reverse_proxy 127.0.0.1:3000 }), make sure DNS points to the server and ports 80 and 443 are open, then run sudo systemctl reload caddy. Caddy gets a Let’s Encrypt certificate by itself and renews it in the background.

​
Before you start

  • Point the domain’s A (and AAAA) record at your server: point a domain.
  • Stop Nginx or Apache if they run; only one program can use ports 80 and 443.
  • Use a user with sudo. If you are root, leave out sudo.
Caddy is a web server and reverse proxy written in Go. Its main feature is automatic HTTPS: for every domain in its config, it requests a certificate from Let’s Encrypt (with ZeroSSL as fallback), redirects HTTP to HTTPS and renews certificates without a cron job.

​
How to install Caddy

The package starts Caddy as the systemd service caddy straight away.
Ubuntu and Debian also have a caddy package in their own repositories, but it is older. Caddy’s repository gets updates first.

​
How to open the firewall

Port 80 is needed to get certificates and redirect visitors. UDP 443 is for HTTP/3; HTTPS still works without it.

​
How to serve a site with automatic HTTPS

Edit the Caddyfile:
Replace the default :80 block with your sites. Three common examples:
Check the file, then reload without downtime:
validate prints Valid configuration when the syntax is correct. Format the file neatly with caddy fmt --overwrite /etc/caddy/Caddyfile.
For the PHP example, PHP-FPM runs as www-data and Caddy runs as caddy. Add Caddy to the group so it can use the socket: sudo usermod -aG www-data caddy, then sudo systemctl restart caddy.

​
How to check it worked

Open https://example.com. The padlock shows a certificate issued by Let’s Encrypt. Watch Caddy get the certificate in the log:
Look for certificate obtained successfully. Certificates and keys are stored in Caddy’s data directory under /var/lib/caddy. Keep it on persistent disk and include it in backups.

​
Frequently asked questions

​
Caddy fails to get a certificate. What should I check?

The domain’s DNS must point to this server, ports 80 and 443 must be reachable from the internet, and nothing else may be using them. Test from outside with check if a port is open. Caddy retries with increasing waits, so fix the cause and run sudo systemctl reload caddy.

​
Do I need Certbot with Caddy?

No. Caddy requests and renews certificates itself. Running Certbot as well only creates certificates Caddy does not use.

​
Should I use Caddy or Nginx?

Caddy is quicker to set up and handles HTTPS for you. Nginx has more tutorials and fine-grained tuning options and is what most control panels use. Both are fine for small and medium sites. See Nginx reverse proxy.

​
Can Caddy serve a site without a domain?

Yes, use :80 { … } for plain HTTP on the IP address. Automatic HTTPS from Let’s Encrypt needs a domain name.

VPS and dedicated server guides

Every server guide in one place.

Node.js with PM2

An app to put behind Caddy.

Point a domain to your server

DNS first, then HTTPS.

Install Nginx

The classic alternative.

Free SSL with Certbot

HTTPS for Nginx and Apache.
Checked against the official Caddy install guide, Automatic HTTPS and Running Caddy pages on 4 November 2026; the example Caddyfile checked with caddy validate on Ubuntu 24.04 LTS (Caddy 2.6.2 from the Ubuntu archive). The Caddy repository install and certificate issuance were not tested. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026