Serve the site over HTTPS on Caddy

Why it matters

Without HTTPS everything visitors send and receive, including passwords and form data, can be read or changed by anyone on the network path. Browsers also label plain http pages as not secure.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Caddy gets and renews certificates by itself when the site address is a host name. Use example.com as the site address instead of http://example.com or :80, and remove any auto_https off option.
2. Make sure ports 80 and 443 reach Caddy from the internet and the DNS records point at this server, then reload Caddy and watch its log for the certificate being obtained. Caddy also redirects http to https automatically.

example.com {
	# ... your existing directives
}

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HTTP to HTTPS redirect check
• Stop redirecting HTTPS to HTTP
• Redirect HTTP to HTTPS
• Fix the broken HTTPS redirect chain
• Shorten the redirect chain
• Fix the HTTP redirect chain
• Redirect HTTP straight to HTTPS
• Answer HTTP with a redirect to HTTPS
• Redirect www and apex to one host
• Make the www or apex name work over HTTPS