3 ms·

What if I just want to generate and use a self signed cert without any CA involvement? I do that with HTTP all the time and it works for the public web even if

• francislavoie 4y ago
  To be clear, Caddy itself manages its own internal CA. It's the same thing as self signing except you have a root cert you can trust, to trust every cert Caddy generates; that's instead of having individual self signed certificates. This makes it significantly easier if you have many subdomains for each of your services, etc. It has nothing to do with corporate CAs, no external entities. QUIC/HTTP3 use the same TLS stack as H1/H2, same things are trusted. So there's no difference there.
• mholt 4y ago
  (Fun-fact, "self-signed" certs also have "CA involvement" -- it's just that the leaf is also the signing authority, which is generally bad practice. Caddy does this properly with a separate signing root -- that stays offline and has long validity -- as Francis explained.)