4 ms·

What makes Caddy setup of Lets Encrypt so much easier? I frequently hear that being a huge reason for Caddy use but looking at the documentation for NGINX [0]

What makes Caddy setup of Lets Encrypt so much easier? I frequently hear that being a huge reason for Caddy use but looking at the documentation for NGINX [0] and Caddy [1], it doesn't seem to be much different. [0] https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/ https://www.nginx.com/blog/using-free-ssltls-certificates-fr... [1] https://caddyserver.com/docs/automatic-https https://caddyserver.com/docs/automatic-https

nullwarp 5y ago
It has no third party tool required
mholt 5y ago
NGINX requires external tooling (e.g. certbot), Caddy's auto-HTTPS is built-in. Caddy's auto-HTTPS logic is much smarter and more robust than certbot or any other ACME client. In general, Caddy sites stay up when other sites will go down due to HTTPS/certificate issues. Certbot+cron is much more brittle than Caddy's embedded handling of certificates. Plus, Caddy has stronger memory safety guarantees than a C program like NGINX. Caddy automatically staples and caches OCSP responses by default, as well. OCSP responder outages? No problem. This sometimes brings sites down (esp. Must-Staple certs in Firefox) because other servers' OCSP stapling implementations are not as robust. I remember when gnu.org went down for a while because of this. Certificate got revoked? No problem, Caddy will automatically detect that via OCSP and replace it for you. Internal throttling and retry logic makes it more resilient to domain validation problems. Caddy will fall back to a secondary CA if your first CA is having trouble issuing a certificate (i.e. multiple default CAs). Not to mention, when using Let's Encrypt, Caddy will retry with its staging endpoint to help avoid rate limit issues. Plus, deploy multiple Caddy instances as a cluster and they will automatically share and coordinate management of certificates and OCSP staples. (Doing this is as simple as configuring each Caddy instance to use the same storage backend.) It's very quick to get started and try out HTTPS: https://caddyserver.com/docs/quick-starts/https https://caddyserver.com/docs/quick-starts/https
- cwaffles 5y ago
  Nginx has an excellent track record for CVEs: https://www.cvedetails.com/product/17956/Nginx-Nginx.html?vendor_id=10048 https://www.cvedetails.com/product/17956/Nginx-Nginx.html?ve...
nicolaslem 5y ago
The automatic HTTPS feature of Caddy is a game changer. I enabled it once on a server five years ago and never had to take a second look. I am surprised that this is not a standard feature of all web servers. There is no way I am fighting with certbot (or whatever the recommended software is) anymore. That being said, the rest of the software is not as amazing. Please nginx, could you add automatic HTTPS so I can ditch Caddy?
- mholt 5y ago
  What is not as amazing?
  - nicolaslem 5y ago
    I have not kept up with Caddy in a long while, so take with a grain of salt: - The weird license debacle. - The weird ads in headers debacle. - I had trouble with advanced usage that should have worked but were not flexible enough, like acting as a cache. - The marketing rubbed me the wrong way. It was pointing the deficiencies in other established FOSS web servers, basically treating them as relics while Caddy itself had 10% of their features.
    - mholt 5y ago
      Hmm, so you're hung up on all things we've fixed with Caddy v2 years ago. I recommend giving it a try again with a fresh mindset. It's a totally different product.
      - nicolaslem 5y ago
        I don't know if the tone of the marketing is fixed. In the past I found the lack of humility surrounding the project off putting. Now I go to the website and the first thing I see is a giant "THE ULTIMATE SERVER", not a good start.
        mholt 5y ago

nullwarp 5y ago

It has no third party tool required

mholt 5y ago

NGINX requires external tooling (e.g. certbot), Caddy's auto-HTTPS is built-in. Caddy's auto-HTTPS logic is much smarter and more robust than certbot or any other ACME client. In general, Caddy sites stay up when other sites will go down due to HTTPS/certificate issues. Certbot+cron is much more brittle than Caddy's embedded handling of certificates. Plus, Caddy has stronger memory safety guarantees than a C program like NGINX. Caddy automatically staples and caches OCSP responses by default, as well. OCSP responder outages? No problem. This sometimes brings sites down (esp. Must-Staple certs in Firefox) because other servers' OCSP stapling implementations are not as robust. I remember when gnu.org went down for a while because of this. Certificate got revoked? No problem, Caddy will automatically detect that via OCSP and replace it for you. Internal throttling and retry logic makes it more resilient to domain validation problems. Caddy will fall back to a secondary CA if your first CA is having trouble issuing a certificate (i.e. multiple default CAs). Not to mention, when using Let's Encrypt, Caddy will retry with its staging endpoint to help avoid rate limit issues. Plus, deploy multiple Caddy instances as a cluster and they will automatically share and coordinate management of certificates and OCSP staples. (Doing this is as simple as configuring each Caddy instance to use the same storage backend.) It's very quick to get started and try out HTTPS: https://caddyserver.com/docs/quick-starts/https https://caddyserver.com/docs/quick-starts/https

cwaffles 5y ago
Nginx has an excellent track record for CVEs: https://www.cvedetails.com/product/17956/Nginx-Nginx.html?vendor_id=10048 https://www.cvedetails.com/product/17956/Nginx-Nginx.html?ve...

nicolaslem 5y ago

The automatic HTTPS feature of Caddy is a game changer. I enabled it once on a server five years ago and never had to take a second look. I am surprised that this is not a standard feature of all web servers. There is no way I am fighting with certbot (or whatever the recommended software is) anymore. That being said, the rest of the software is not as amazing. Please nginx, could you add automatic HTTPS so I can ditch Caddy?

mholt 5y ago
What is not as amazing?
- nicolaslem 5y ago
  I have not kept up with Caddy in a long while, so take with a grain of salt: - The weird license debacle. - The weird ads in headers debacle. - I had trouble with advanced usage that should have worked but were not flexible enough, like acting as a cache. - The marketing rubbed me the wrong way. It was pointing the deficiencies in other established FOSS web servers, basically treating them as relics while Caddy itself had 10% of their features.
  - mholt 5y ago
    Hmm, so you're hung up on all things we've fixed with Caddy v2 years ago. I recommend giving it a try again with a fresh mindset. It's a totally different product.
    - nicolaslem 5y ago
      I don't know if the tone of the marketing is fixed. In the past I found the lack of humility surrounding the project off putting. Now I go to the website and the first thing I see is a giant "THE ULTIMATE SERVER", not a good start.
      - mholt 5y ago