# Distribute Caddy local CA trust to the clients that need it

> Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.

- Canonical URL: https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T00:43:34+00:00
- Modified: 2026-10-15T00:44:33+00:00
- Last reviewed by DSE: 2026-10-14
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.

## Potentially affected

Use this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.

## DSE recommendation

DSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location.

## Article

Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.

## Source facts

Caddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.

Source: [Caddy — Automatic HTTPS, Local HTTPS](https://caddyserver.com/docs/automatic-https).

## Applicability

Use this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.

## DSE recommendation

DSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.

## Verification

Connect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.

## Official reference

[Caddy — Automatic HTTPS, Local HTTPS](https://caddyserver.com/docs/automatic-https). Reviewed October 14, 2026.

## Primary reference

- Name: Caddy — Automatic HTTPS, Local HTTPS
- Authority: caddyserver.com
- URL: https://caddyserver.com/docs/automatic-https
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distribute Caddy local CA trust to the clients that need it,” DSE Security, https://update.dsesecurity.com/updates/caddy-local-https-client-root-trust/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.