0

So, I have this Caddyfile

{
    local_certs
    debug
}

* {
    respond "Hello, Default! {host}"
}

and this docker-compose.yml

version: "3.7"

services:
  caddy:
    image: caddy
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro

I get an SSL Handshake error (not cert error) when trying to open https://sub1.localhost/ or https://127.0.0.1/ (the -k is to ignore cert errors):

> curl -i -k "https://localhost/"
HTTP/1.1 200 OK
Alt-Svc: h3=":443"; ma=2592000
Content-Type: text/plain; charset=utf-8
Server: Caddy
Date: Sat, 02 Mar 2024 14:46:19 GMT
Content-Length: 25

Hello, Default! localhost

> curl -i -k "https://sub1.localhost/"
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.

> curl -i -k "https://127.0.0.1/"
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.

The Log says http: TLS handshake error from 172.22.0.1:44886: no certificate available for 'sub1.localhost'

Why?

https://caddyserver.com/docs/automatic-https#overview even has 127.0.0.1 and localhost as an example that Caddy should serve via a locally created certificate.

Isn't Caddy supposed to serve that via a self generated cert?

1 Answer 1

1

Since you are testing with Curl, SNI could be an issue here. Try with the --resolve option as explained here: https://caddy.community/t/why-curl-fails-while-browser-calls-succeed/9841/2

And since it appears that you have not provisioned sub1.localhost in your Caddy file, you should implement On-Demand TLS if you expect Caddy to generate the certificate dynamically. Have a look here for a tutorial: Serving tens of thousands of domains over HTTPS with Caddy

But for localhost you will probably want something like this instead (untested):

https:// {
    tls internal {
        on_demand
    }
}

Be sure to check the Caddy logs to troubleshoot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.