Teploy

SSL Certificates

2 min read

Every public domain gets a free certificate automatically via Let's Encrypt, issued and renewed by Caddy — the reverse proxy teploy setup installs on your server. There's no separate certificate-management step or account to create.

How it works

  1. You set domain: in teploy.yml and run teploy deploy
  2. Point your domain's DNS A record at your server's IP
  3. Caddy requests a Let's Encrypt certificate for the domain on first request
  4. Certificate is issued within seconds once DNS resolves and port 80 is reachable
  5. Caddy renews automatically well before expiry — no action needed

No configuration needed for a normal public domain. No external accounts required.

Checking certificate status

There's no separate certificate dashboard — Caddy's own logs are the source of truth:

teploy exec <server> "docker logs caddy --tail 100"

teploy status shows whether the app's containers are healthy and routed; a working HTTPS response on the domain is the practical signal the certificate issued successfully.

Troubleshooting

Certificate not issuing / deploy hangs on routing

  1. Verify your A record points at your server's IP address (dig +short yourdomain.com)
  2. Ensure port 80 is reachable from the internet — Let's Encrypt's HTTP-01 challenge requires it, and teploy's firewall setup keeps it open by default
  3. Check nothing else on the server is bound to 80/443 outside of the Caddy container
  4. If the domain is a bare IP, .local, or otherwise not publicly resolvable, teploy serves it over plain HTTP instead of attempting ACME — see Custom Domains for the tls: internal opt-in

Let's Encrypt rate limits

Let's Encrypt limits certificate issuance per domain (50/week as of writing). Repeatedly tearing down and redeploying the same domain in a short window can hit this — Caddy caches issued certs on disk (caddy_data volume) across deploys specifically to avoid re-requesting on every deploy.

Optional: Cloudflare SSL

If you connect Cloudflare for CDN, you can choose their SSL modes instead:

Mode Description
Full (Strict) End-to-end encryption with valid origin cert
Full Encrypts to origin (accepts self-signed)
Flexible Only encrypts to Cloudflare edge

See Cloudflare Setup for details.

On this page