Distribute Caddy local CA trust to the clients that need it

Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.

Source facts

Caddy documents automatic HTTPS for local and internal names using its own certificate authority. Clients trust that chain only where the CA’s root certificate has been installed appropriately. Caddy attempts local trust-store installation for convenience, but this is not guaranteed, especially in containers or when running as an unprivileged service. The administrator remains responsible for the trust stores needed by actual clients.

Source: Caddy — Automatic HTTPS, Local HTTPS.

Applicability

Use this guide for Caddy’s local CA workflow. Public ACME-issued certificates follow a different trust arrangement; identify which issuer the service is actually using.

DSE recommendation

DSE recommends recording the internal service names, intended client applications, CA public fingerprint, trust-distribution owner, and server storage location. Distribute the verified public root certificate through the approved client-management process. Protect the CA’s private material and backups separately from the public trust package. Include browsers, service accounts, and application runtimes in the client inventory because the acceptance check should reflect real consumers. Plan renewal and recovery ownership rather than treating successful server startup as completion.

Verification

Connect from representative clients using the intended hostname without bypassing certificate errors. Check the presented chain and trusted root. Confirm that a client outside the approved trust configuration reports the expected trust failure in a test environment. Retain the client matrix and sanitized results.

Official reference

Caddy — Automatic HTTPS, Local HTTPS. Reviewed October 14, 2026.