Replace the self-signed certificate with a trusted one on Caddy
Why it matters
A self-signed certificate is not vouched for by any authority browsers trust, so every visitor sees a security warning. Many API clients refuse the connection altogether.
The fix
- Caddy uses a public certificate automatically when the site address is a real hostname that points at the server. A self-signed certificate means Caddy fell back to its own internal CA, which happens for localhost, IP addresses, the tls internal directive, or when public issuance failed.
- Remove any tls internal line, make sure the site address is the public hostname, and make sure ports 80 and 443 are reachable from the internet. Then reload Caddy.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.