{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/caddy-local-https-client-root-trust/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
        "slug": "caddy-local-https-client-root-trust",
        "url": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/caddy-local-https-client-root-trust/"
        },
        "title": "Distribute Caddy local CA trust to the clients that need it",
        "summary": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T00:43:34+00:00",
        "modified_at": "2026-10-15T00:44:33+00:00",
        "reviewed_on": "2026-10-14",
        "reading_minutes": 2,
        "word_count": 246,
        "potentially_affected": "Use this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.",
        "dse_recommendation": "DSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location.",
        "primary_source": {
            "name": "Caddy — Automatic HTTPS, Local HTTPS",
            "url": "https://caddyserver.com/docs/automatic-https",
            "published_on": null,
            "authority": "caddyserver.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.</p>\n<h2>Source facts</h2>\n<p>Caddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.</p>\n<p>Source: <a href=\"https://caddyserver.com/docs/automatic-https\">Caddy — Automatic HTTPS, Local HTTPS</a>.</p>\n<h2>Applicability</h2>\n<p>Use this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.</p>\n<h2>Verification</h2>\n<p>Connect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://caddyserver.com/docs/automatic-https\">Caddy — Automatic HTTPS, Local HTTPS</a>. Reviewed October 14, 2026.</p>",
        "content_text": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.\nSource facts\nCaddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.\nSource: Caddy — Automatic HTTPS, Local HTTPS.\nApplicability\nUse this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.\nDSE recommendation\nDSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.\nVerification\nConnect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.\nOfficial reference\nCaddy — Automatic HTTPS, Local HTTPS. Reviewed October 14, 2026.",
        "content_markdown": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.\n\n## Source facts\n\nCaddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.\n\nSource: [Caddy — Automatic HTTPS, Local HTTPS](https://caddyserver.com/docs/automatic-https).\n\n## Applicability\n\nUse this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.\n\n## DSE recommendation\n\nDSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.\n\n## Verification\n\nConnect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.\n\n## Official reference\n\n[Caddy — Automatic HTTPS, Local HTTPS](https://caddyserver.com/docs/automatic-https). Reviewed October 14, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
                "url": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-14"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Distribute Caddy local CA trust to the clients that need it",
                        "item": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/#article",
                "identifier": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
                "url": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/",
                "headline": "Distribute Caddy local CA trust to the clients that need it",
                "description": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.",
                "abstract": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.",
                "articleBody": "Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.\nSource facts\nCaddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.\nSource: Caddy — Automatic HTTPS, Local HTTPS.\nApplicability\nUse this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.\nDSE recommendation\nDSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.\nVerification\nConnect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.\nOfficial reference\nCaddy — Automatic HTTPS, Local HTTPS. Reviewed October 14, 2026.",
                "datePublished": "2026-10-15T00:43:34+00:00",
                "dateModified": "2026-10-15T00:44:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Distribute Caddy local CA trust to the clients that need it"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 246,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Caddy — Automatic HTTPS, Local HTTPS",
                    "url": "https://caddyserver.com/docs/automatic-https"
                }
            }
        ]
    }
}