How can I use Server certificates generated by Caddy for the Postfix service?
Currently, I can only use certificates generated by ACME for the Postfix service.
All certificates are listed in the `system/trust` directory (ACME and caddy).
my current hack on opensense cli:
postconf -e 'smtpd_tls_cert_file=/var/db/caddy/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mydomain.xxx.com/mydomain..xxx.com.crt'
postconf -e 'smtpd_tls_key_file=/var/db/caddy/data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mydomain.xxx.com/mydomain.xxx.com.key'
service postfix restart
check from other machine:
openssl s_client -connect mydomain.xxx.com:25 -starttls smtp | openssl x509 -noout -dates
Quote from: rudiratlos63 on July 02, 2026, 05:43:16 PMHow can I use Server certificates generated by Caddy for the Postfix service?
You can't. And as far as I know the certificate service in Caddy will be removed in favour of handling everything in the ACME client.
@Monviech can you confirm?
Hmm no nothing about caddy will be changed. It will still issue its own certificates.
But they cannot be used in other services on the OPNsense, and there is no plan to add such capability.
Quote from: Monviech (Cedrik) on July 02, 2026, 08:47:05 PMHmm no nothing about caddy will be changed. It will still issue its own certificates.
@JeGr told me in our last online meeting you were deprecating all certificate handling in Caddy in favour of ACME. Well ...
Huh I never said that nor have any issue anywhere that states that. Sounds like misinformation.
What I did was splitting the Caddy plugins up, into one with all DNS providers and a xcaddy plugin here:
https://github.com/Monviech/os-caddy
And the standard one with just Cloudflare here:
https://github.com/opnsense/plugins/tree/master/www/caddy
But thats already like this since a year or so now. Nothing more is planned around these facts.
I've always had trouble using ACME to generate up-to-date certificates for my Postfix service.
The setup was just too complicated to reliably generate a simple certificate and keep
it up to date. Caddy does it better, faster, more reliably, and more easily.
So it would be nice if Postfix allowed you to specify the
two Caddy certificate paths as optional parameters.
I know how nice it works but there is no plan to make the certificates available in other components. I do not want to maintain a connection between the certificate authority model of the OPNsense and Caddies certificate deployment, which are very different by nature.
Potentially you could use Caddys Layer 4 proxy to TLS offload the Mail Port, but not sure if it works with STARTTLS as the module currently has no support for it: https://github.com/mholt/caddy-l4/issues/384
thats a real problem/pitty. therefor caddy is not useable if postfix needs a cert for tls transfer. caddy uses port 80 and if I want to use acme for this specifc domain only. during cert renewal acme ist spinning up port 80 for HTTP-01 challange (my registrar is not offering DNS-01). acme offers an hook after the cert renewal for spinning up caddy and not before for spinning down caddy.
it whould be a very good help if caddy could call a script/action routine after successfull renewal of a specfic cert. with that hook, some adjustments could be made e.g. remap/copy cert file for postfix service an reload/restart postfix.
Caddy is not a general purpose ACME certificate tool.
The ACME capabilities of caddy without its reverse proxy core would be certmagic:
https://github.com/caddyserver/certmagic
CertMagic is designed to be embedded into Go applications, with certificate management tightly integrated into the application itself.
The whole framework is for packaging the ACME capabilities with the tools, not having a swiss army knife for any application like for example the acme.sh project.
All in all there is nothing we can or should do here, the generic tool for the job is acme.sh.
I tried disabling the OpenSense Postfix proxy and generating a certificate via the HTTP-01 challenge using acme.sh on my Proxmox MailGateway (PMG). Caddy forwards the domain (e.g. mail.mydomain.com) to my PMG as a reverse proxy over the HTTP protocol. From the outside, a test web server on the PMG is accessible via HTTP without any issues. However, when I run acme.sh with the standalone option (acme.sh --issue -d mail.mydomain.com --standalone --httpport 80 --log), the certificate issuance fails. I've now run out of options for running Caddy on OpenSense. It would be really handy to use Caddy certificates for the OpenSense Postfix service.
You can forward the acme challenge like this:
https://docs.opnsense.org/manual/how-tos/caddy.html#redirect-acme-http-01-challenge
Thanks, that's the solution to my problem. I'm already forwarding the ACME HTTP-01 Challenge redirect to my Proxmox Mail Gateway (PMG), and it's working. I'm not sure if the TLS-ALPN-01 works for Caddy itself, since my internet provider doesn't offer IPv6. However, I'm having an issue with my PMG, which sends a spam report via email and provides a link to the same domain for marking spam emails as such. Here, access is routed through the reverse proxy to the PMG website itself, and a certificate for Caddy itself is required for this.