Select a TLS mode
Open System Settings → HTTPS & TLS. Choose HTTP only, an uploaded PEM certificate/key, or ACME with a public or custom directory. Caddy is the managed proxy; default host ports are HTTP 8080 and HTTPS 8443.
Certificates and reachability
Uploaded certificates are checked for matching keys, validity dates, and DNS SAN coverage. Public ACME issuance requires the selected CA’s challenge ports to be reachable; a nonstandard HTTPS port alone does not satisfy standard port 80/443 challenges. The built-in setup does not include DNS-01 provider plugins.
Point the plugin to HTTPS
Use the final HTTPS hostname and port in the plugin endpoint. Leave certificate verification enabled. For an internal CA, provide the root CA using tlsCaCertificatePath; hostname validation still applies.
Rotate API keys
Create a named key under Access & Security. Copy it when created, update the resolver, verify authenticated traffic, then disable the old key. Keys are stored as hashes and cannot be recovered later. Existing bootstrap environment variables do not overwrite database credentials.