Messages

Hi,

Hallo,

Auf meiner opnsense ist der ACME-Client und der caddy proxy eingerichtet, als lokalen DNS nutze ich unbound.
Caddy verteilt das Let's Encrypt Wildcard Zertifikat an die Dienste die in meinem Netz laufen,

d.h., du hast ein Wildcard-Zertifikate für *.mydomain.de, das der ACME-Client besorgt, und das auch in jedem Frontend in Caddy angegeben?
Und vielleicht auch in den General Settings "Auto HTTPS" deaktiviert?

Ich habe unter caddy/Reverse proxy/domains eine domain *.mydomain.de angelegt und dort als Certificate mein wildcard Let's encrypt Zertifikat, heißt mydomain.de (ACME Client) ausgewählt. Dann habe ich für z.B. jeden switch eine subdomain angelegt, also switch1.mydomain.de und switch2.mydomain.de angelegt. Der entsprechende Handler hat als protocol http und als IP die entsprechende IP des switch eingegeben. Für switch1 wird eine https-Verbindung aufgebaut und die Login Maske erscheint, bei switch2 wird anscheinden auch einen https-Verbindug aufgebaut, zumindest zeigt der Browser das Schild vor der URL, aber die Seite bleibt weiß die Login Maske erscheint nicht. Wenn ich den switch2 direkt über die IP anspreche funktioniert es.

Bei switch1 kommt eine https Verbindung zustande bei switch2 nicht

Wie genau äußert sich das?

In der logdatei von caddy findet ich zu switch2 folgendes

Code Select Expand

2026-10-31T14:42:44    Debug    caddy     "debug","ts":"2026-10-31T13:42:44Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.223602661,"request":{"remote_ip":"192.168.64.51","remote_port":"38366","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/app.e075fc3b.gzip.js","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["script"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept":["*/*"],"X-Forwarded-Host":["switch2.mydomain.de"],"Via":["2.0 Caddy"],"Sec-Fetch-Mode":["no-cors"],"Sec-Fetch-Site":["same-origin"],"Te":["trailers"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"X-Forwarded-For":["192.168.64.51"],"Referer":["https://switch2.mydomain.de/main.html"],"Dnt":["1"],"Sec-Gpc":["1"],"Cookie":["REDACTED"],"X-Forwarded-Proto":["https"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch1.mydomain.de","ech":false}},"headers":{"Cache-Control":["must-revalidate"],"Etag":["\"1774072632-206311\""],"X-Xss-Protection":["1; mode=block"],"Set-Cookie":["REDACTED"],"Content-Length":["206311"],"Content-Type":["application/javascript; charset=UTF-8"],"X-Frame-Options":["SAMEORIGIN"],"X-Content-Type-Options":["nosniff"],"Content-Encoding":["gzip"],"Date":["Wed, 29 Apr 2026 00:37:30"]},"status":200}
2026-10-31T14:42:44    Debug    caddy     "debug","ts":"2026-10-31T13:42:44Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.105739659,"request":{"remote_ip":"192.168.64.51","remote_port":"38366","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/chunk-elementUI.22a0a6c6.gzip.js","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["script"],"Sec-Fetch-Mode":["no-cors"],"X-Forwarded-Proto":["https"],"Accept":["*/*"],"Sec-Fetch-Site":["same-origin"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"X-Forwarded-Host":["switch2.mydomain.de"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Cookie":["REDACTED"],"Te":["trailers"],"X-Forwarded-For":["192.168.64.51"],"Referer":["https://switch2.mydomain.de/main.html"],"Dnt":["1"],"Sec-Gpc":["1"],"Via":["2.0 Caddy"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch1.mydomain.de","ech":false}},"headers":{"Content-Type":["application/javascript; charset=UTF-8"],"Cache-Control":["must-revalidate"],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"],"Content-Encoding":["gzip"],"Content-Length":["156512"],"Date":["Wed, 29 Apr 2026 00:37:30"],"Etag":["\"1774072632-156512\""],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"]},"status":200}
2026-10-31T14:42:44    Debug    caddy     "debug","ts":"2026-10-31T13:42:44Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.069756515,"request":{"remote_ip":"192.168.64.51","remote_port":"38366","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/chunk-echarts.a837dac1.gzip.js","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Accept":["*/*"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Gpc":["1"],"Sec-Fetch-Site":["same-origin"],"Dnt":["1"],"Referer":["https://switch2.mydomain.de/main.html"],"Cookie":["REDACTED"],"Sec-Fetch-Mode":["no-cors"],"Te":["trailers"],"X-Forwarded-Proto":["https"],"X-Forwarded-Host":["switch2.mydomain.de"],"Via":["2.0 Caddy"],"Sec-Fetch-Dest":["script"],"X-Forwarded-For":["192.168.64.51"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch1.mydomain.de","ech":false}},"headers":{"Content-Length":["133941"],"Date":["Wed, 29 Apr 2026 00:37:30"],"Content-Type":["application/javascript; charset=UTF-8"],"Cache-Control":["must-revalidate"],"Etag":["\"1774072632-133941\""],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Encoding":["gzip"],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"]},"status":200}
2026-10-31T14:42:43    Debug    caddy     "debug","ts":"2026-10-31T13:42:43Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-31T14:42:43    Debug    caddy     "debug","ts":"2026-10-31T13:42:43Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-31T14:42:43    Debug    caddy     "debug","ts":"2026-10-31T13:42:43Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
Stutzig macht mich dabei das an mancher Stelle switch1.mydomain.de auftaucht.

In einer anderen VM läuft Debian 13 als Host für Docker Container, der öehnt die Verbindung ab, wieso habe ich noch nicht rausfinden können. Denn wenn ich nicht caddy benutze sondern im lokalen Netzwerk DNS mittels Unbound mache, dann kann ich auf den Dockerhost zugreifen, halt ohne https. Da cadyy logfile sagt dazu:

Code Select Expand

"warn","ts":"2026-10-31T18:43:54Z","logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"192.168.64.25:9443","duration":0.001091551,"request":{"remote_ip":"192.168.64.51","remote_port":"52754","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"dockerhost.mydomain.de","uri":"/","headers":{"Sec-Gpc":["1"],"Sec-Fetch-Mode":["navigate"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Sec-Fetch-Site":["none"],"X-Forwarded-Host":["dockerhost.mydomain.de"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Sec-Fetch-Dest":["document"],"X-Forwarded-Proto":["https"],"Via":["2.0 Caddy"],"Dnt":["1"],"Priority":["u=0, i"],"Upgrade-Insecure-Requests":["1"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-User":["?1"],"Te":["trailers"],"X-Forwarded-For":["192.168.64.51"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"dockerhost.mydomain.de","ech":false}},"error":"reading: read tcp 192.168.64.1:3540->192.168.64.25:9443: read:connection reset by peer"}
Die Webbrowser geben heute speziell bei SSL-Problemen aber meist keine vernünftige Fehlermeldung aus. Wenn du cURL oder OpenSSL verfügbar hast, untersuche die Serverantwort damit.

Mit cURL

Code Select Expand

curl -v https://switch2.mydomain.deDas zeigt, auf welche Domain das gelieferte Zertifikat ausgestellt ist.
Mache dasselbe mit switch1 zum Vergleich.

Die Ausgabe dazu sieht soweit ich das beurteilen kann auch in Ordnung aus:

switch1

Code Select Expand

curl -v https://switch1.mydomain.de
* Host switch1.mydomain.de:443 was resolved.
* IPv6: (none)
* IPv4: mypublicIP
*   Trying mypublicIP:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=mydomain.de
*   start date: Oct 23 12:27:27 2026 GMT
*   expire date: Jan 21 12:27:26 2027 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YR1
*   Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 3: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "switch1.mydomainr.de" matches cert's "*.mydomain.de"
* SSL certificate verified via OpenSSL.
* Established connection to switch1.mydomain.de (mypublicIP port 443) from 192.168.64.51 port 33808
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://switch1.mydomainr.de/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: switch1.mydomain.de]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.18.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: switch1.mydomain.de
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200
< cache-control: no-store
< content-type: text/html; charset=utf-8
< via: 1.1 Caddy
< content-length: 466
< date: Sun, 01 Nov 2026 15:29:50 GMT
<
<html>
<script>RT='/DGS-1100-24_1.10.B020/';
Prefix="<script src='"+RT+"FilenamePrefix.js'></s";
Prefix+='cript>';
document.write(Prefix);
</script>
<title>Login</title>
<script>jsInclude(0,'login.js');</script>
<script>
InitCookie();
docW("<frameset><center>");
docW("<frame src='"+RD+"login2.htm' frameborder='no' scrolling='yes' noresize marginhight=0>");
</script>
<noframes>
sorry, your browser does not support frames.
</noframes>
</center></frameset>
</html>
* Connection #0 to host switch1.mydomain.de:443 left intact

switch2

Code Select Expand

curl -v https://switch2.mydomain.de
* Host switch2.mydomain.de:443 was resolved.
* IPv6: (none)
* IPv4: mypublicIP
*   Trying mypublicIP:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=mydomain.de
*   start date: Oct 23 12:27:27 2026 GMT
*   expire date: Jan 21 12:27:26 2027 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YR1
*   Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 3: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   subjectAltName: "switch2.mydomain.de" matches cert's "*.mydomain.de"
* SSL certificate verified via OpenSSL.
* Established connection to switch2.mydomain.de (mypublicIP port 443) from 192.168.64.51 port 48742
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://switch2.mydomain.de/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: switch2.mydomain.de]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.18.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: switch2.mydomain.de
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200
< cache-control: no-cache
< content-type: text/html; charset=UTF-8
< date: Thu, 30 Apr 2026 02:23:31
< set-cookie: HttpOnly=true;HttpOnly;Secure
< via: 1.1 Caddy
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-xss-protection: 1; mode=block
<
<!DOCTYPE html>
<html>

<head>
  <meta charset=utf-8>
  <meta name=viewport content="width=device-width,initial-scale=1">
  <script type=text/javascript>
    document.writeln('<script type="text/javascript" src="/iss/specific/const_common.js?&_='+new Date().getTime()+'"></s'+'cript>');
  </script>
  <link id="logo" rel="shortcut icon" type="image/x-icon" />
  <script type=text/javascript>
    document.writeln('<script type="text/javascript" src="/static/specific/config.js'+'"></s'+'cript>');
    document.getElementById('logo').href = '/static/specific/favicon.ico';
  </script>
  <script>
    function receiveMessage(event) {
      const arrurl = window.location.href.split('/')
      const url = arrurl[0] + '//' + arrurl[2]
      if (event.origin !== url) { // 安全问题，需在同一个域名
        return
      }
      // 解login进入后输入chklst.txt无效问题
      if (arrurl[3] && arrurl[3].indexOf('chklst.txt') !== -1) {
        const key = 'FFBF48953A799EEF6FC8EC5F4E09916E'
        const gibt = sessionStorage.getItem(key)
        if (gibt) {
          sessionStorage.removeItem(key)
          window.location.replace(window.location.href)
        }
      }
      event.source.postMessage("checkindexok ", event.origin) // 使用event.origin取代 '*', '*'存在安全问题
      if (typeof event.data !== 'string') {
        return
      }
      if (event.data.indexOf('NewIP') !== -1) {
        const objData = JSON.parse(event.data)
        const newUrl = objData.NewIP
        const TimeOut = (typeof objData.TimeOut !== 'undefined') ? objData.TimeOut : 1000
        if (TimeOut > 1000 && TimeOut < 240000) { //1000: 1秒 ， 240000：4 分钟
          setTimeout(function() {
            window.location.replace(newUrl)
          }, TimeOut)
        }
      }
      if (event.data.indexOf('reload') !== -1) { // reload
        // 方式1在chrome与ie11下可以重新加载，但是firefox下显示"Error: Incorrect contents fetched, please reload."
        // 暂时使用方式2可以兼容三种浏览器
        // 方式1
        // window.location.reload()
        // 方式2
        window.open(location.href,'_self')
      }
    }
    // 用于check index iframe loading
    window.addEventListener('message', receiveMessage, false)
    function changeFrameHeight() {
      var ifm = document.getElementById("iframemain");
      ifm.width = document.documentElement.clientWidth;
      ifm.height = document.documentElement.clientHeight;
    }
    window.onresize = function () {
      changeFrameHeight();
    }
  </script>
</head>

<body onLoad="pageInit()" style="margin:0;padding:0;overflow: hidden;">
  <div>
    <iframe name="iframemain" src="/main.html" id="iframemain" marginheight="0" frameborder="0" scrolling="yes"
      onload="changeFrameHeight()" width="1024" height="860"></iframe>
  </div>
</body>

</html>
* Connection #0 to host switch2.mydomain.de:443 left intact

Danke und Gruß

Das caddy Logfile gibt folgendes aus, ich kann es aber nicht interpretieren.

Code Select Expand

2026-10-30T17:54:32    Debug    caddy     "debug","ts":"2026-10-30T16:54:32Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.052350115,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/i18n.js?&_=2b7b22dd989186daa738e67bbabe372676a3e229|57a9b70affed53b40eb814e53bf85a12f90abdd8","headers":{"Cookie":["REDACTED"],"Sec-Fetch-Dest":["script"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept":["*/*"],"Sec-Fetch-Mode":["no-cors"],"Dnt":["1"],"Te":["trailers"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Sec-Gpc":["1"],"Via":["2.0 Caddy"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Referer":["https://switch2.mydomain.de/main.html"],"Sec-Fetch-Site":["same-origin"],"If-None-Match":["\"1735109074-404\""],"X-Forwarded-For":["192.168.64.51"],"X-Forwarded-Proto":["https"],"X-Forwarded-Host":["switch2.mydomain.de"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Date":["Tue, 28 Apr 2026 03:51:02"],"Cache-Control":["must-revalidate"],"Etag":["\"1735109074-404\""],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"],"Content-Type":["application/javascript; charset=UTF-8"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Length":["0"]},"status":304}
2026-10-30T17:54:32    Debug    caddy     "debug","ts":"2026-10-30T16:54:32Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.225350585,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/chunk-echarts.a837dac1.gzip.js","headers":{"Te":["trailers"],"If-None-Match":["\"1735109074-133941\""],"Dnt":["1"],"X-Forwarded-Proto":["https"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Referer":["https://switch2.mydomain.de/main.html"],"Via":["2.0 Caddy"],"Sec-Fetch-Mode":["no-cors"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["script"],"Cookie":["REDACTED"],"X-Forwarded-For":["192.168.64.51"],"X-Forwarded-Host":["switch2.mydomain.de"],"Sec-Fetch-Site":["same-origin"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept":["*/*"],"Sec-Gpc":["1"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Cache-Control":["must-revalidate"],"Etag":["\"1735109074-133941\""],"X-Xss-Protection":["1; mode=block"],"Content-Encoding":["gzip"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["application/javascript; charset=UTF-8"],"X-Frame-Options":["SAMEORIGIN"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Length":["0"]},"status":304}
2026-10-30T17:54:32    Debug    caddy     "debug","ts":"2026-10-30T16:54:32Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:32    Debug    caddy     "debug","ts":"2026-10-30T16:54:32Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.173349682,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/specific/version.json?&_=1793379271834","headers":{"Referer":["https://switch2.mydomain.de/main.html"],"Sec-Fetch-Dest":["script"],"Sec-Fetch-Mode":["no-cors"],"Sec-Fetch-Site":["same-origin"],"Priority":["u=2"],"Dnt":["1"],"Via":["2.0 Caddy"],"Te":["trailers"],"Cookie":["REDACTED"],"X-Forwarded-For":["192.168.64.51"],"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Gpc":["1"],"X-Forwarded-Proto":["https"],"X-Forwarded-Host":["switch2.mydomain.de"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Date":["Tue, 28 Apr 2026 03:51:02"],"X-Xss-Protection":["1; mode=block"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Type":["application/javascript; charset=UTF-8"],"Cache-Control":["must-revalidate"],"Etag":["\"1735109074-100\""],"X-Frame-Options":["SAMEORIGIN"],"Content-Length":["100"]},"status":200}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.153519404,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/css/app.a0104dcc.gzip.css","headers":{"Priority":["u=2"],"Accept-Encoding":["gzip, deflate, br, zstd"],"If-None-Match":["\"1735109074-40861\""],"X-Forwarded-Host":["switch2.mydomain.de"],"Via":["2.0 Caddy"],"Sec-Fetch-Dest":["style"],"Sec-Fetch-Site":["same-origin"],"Sec-Gpc":["1"],"Referer":["https://switch2.mydomain.de/main.html"],"X-Forwarded-Proto":["https"],"Cookie":["REDACTED"],"Sec-Fetch-Mode":["no-cors"],"Te":["trailers"],"X-Forwarded-For":["192.168.64.51"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Dnt":["1"],"Accept":["text/css,*/*;q=0.1"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Cache-Control":["must-revalidate"],"X-Xss-Protection":["1; mode=block"],"Set-Cookie":["REDACTED"],"Content-Encoding":["gzip"],"Content-Length":["0"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["text/css"],"Etag":["\"1735109074-40861\""],"X-Frame-Options":["SAMEORIGIN"],"X-Content-Type-Options":["nosniff"]},"status":304}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.139738517,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/iss/specific/const_common.js?&_=1793379271833","headers":{"Cookie":["REDACTED"],"X-Forwarded-For":["192.168.64.51"],"X-Forwarded-Host":["switch2.mydomain.de"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Dnt":["1"],"Sec-Gpc":["1"],"Accept":["*/*"],"X-Forwarded-Proto":["https"],"Referer":["https://switch2.mydomain.de/main.html"],"Sec-Fetch-Mode":["no-cors"],"Te":["trailers"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Via":["2.0 Caddy"],"Sec-Fetch-Dest":["script"],"Sec-Fetch-Site":["same-origin"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Etag":["\"\""],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Length":["135"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["text/html; charset=UTF-8"],"Cache-Control":["must-revalidate"]},"status":404}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.120225931,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/app.061eac30.gzip.js","headers":{"Sec-Fetch-Mode":["no-cors"],"If-None-Match":["\"1735109074-206283\""],"Accept-Encoding":["gzip, deflate, br, zstd"],"Dnt":["1"],"Sec-Gpc":["1"],"Cookie":["REDACTED"],"X-Forwarded-Host":["switch2.mydomain.de"],"Sec-Fetch-Dest":["script"],"Accept":["*/*"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Te":["trailers"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"X-Forwarded-For":["192.168.64.51"],"Sec-Fetch-Site":["same-origin"],"X-Forwarded-Proto":["https"],"Via":["2.0 Caddy"],"Referer":["https://switch2.mydomain.de/main.html"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Content-Type":["application/javascript; charset=UTF-8"],"Cache-Control":["must-revalidate"],"X-Xss-Protection":["1; mode=block"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Length":["0"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Etag":["\"1735109074-206283\""],"X-Frame-Options":["SAMEORIGIN"],"Content-Encoding":["gzip"]},"status":304}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.105641915,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/js/chunk-elementUI.22a0a6c6.gzip.js","headers":{"Sec-Fetch-Mode":["no-cors"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Referer":["https://switch2.mydomain.de/main.html"],"Sec-Fetch-Dest":["script"],"X-Forwarded-For":["192.168.64.51"],"Sec-Gpc":["1"],"Accept":["*/*"],"Sec-Fetch-Site":["same-origin"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"X-Forwarded-Proto":["https"],"X-Forwarded-Host":["switch2.mydomain.de"],"Via":["2.0 Caddy"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Dnt":["1"],"Te":["trailers"],"Cookie":["REDACTED"],"If-None-Match":["\"1735109074-156512\""]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Set-Cookie":["REDACTED"],"Content-Length":["0"],"Date":["Tue, 28 Apr 2026 03:51:02"],"X-Xss-Protection":["1; mode=block"],"Content-Encoding":["gzip"],"Content-Type":["application/javascript; charset=UTF-8"],"Cache-Control":["must-revalidate"],"Etag":["\"1735109074-156512\""],"X-Frame-Options":["SAMEORIGIN"],"X-Content-Type-Options":["nosniff"]},"status":304}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.030490059,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/main.html","headers":{"If-None-Match":["\"1735109074-19549\""],"Upgrade-Insecure-Requests":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"X-Forwarded-Host":["switch2.mydomain.de"],"Via":["2.0 Caddy"],"Referer":["https://switch2.mydomain.de/"],"Sec-Fetch-Site":["same-origin"],"Cookie":["REDACTED"],"Sec-Fetch-Dest":["iframe"],"Dnt":["1"],"Sec-Fetch-Mode":["navigate"],"Te":["trailers"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Sec-Gpc":["1"],"X-Forwarded-For":["192.168.64.51"],"X-Forwarded-Proto":["https"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Priority":["u=4"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Set-Cookie":["REDACTED"],"X-Frame-Options":["SAMEORIGIN"],"Content-Length":["0"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["text/html; charset=UTF-8"],"Cache-Control":["must-revalidate"],"Etag":["\"1735109074-19549\""],"X-Xss-Protection":["1; mode=block"],"X-Content-Type-Options":["nosniff"]},"status":304}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.030149898,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/static/specific/config.js","headers":{"Sec-Gpc":["1"],"X-Forwarded-Host":["switch2.mydomain.de"],"Dnt":["1"],"Cookie":["REDACTED"],"Sec-Fetch-Mode":["no-cors"],"Accept":["*/*"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Fetch-Dest":["script"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"Via":["2.0 Caddy"],"If-None-Match":["\"1735109074-97\""],"Te":["trailers"],"Referer":["https://switch2.mydomain.de/"],"X-Forwarded-Proto":["https"],"X-Forwarded-For":["192.168.64.51"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Sec-Fetch-Site":["same-origin"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Content-Type":["application/javascript; charset=UTF-8"],"Etag":["\"1735109074-97\""],"X-Frame-Options":["SAMEORIGIN"],"X-Content-Type-Options":["nosniff"],"Set-Cookie":["REDACTED"],"Content-Length":["0"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Cache-Control":["must-revalidate"],"X-Xss-Protection":["1; mode=block"]},"status":304}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.029144807,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/iss/specific/const_common.js?&_=1793379271700","headers":{"Te":["trailers"],"Sec-Fetch-Site":["same-origin"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"X-Forwarded-Host":["switch2.mydomain.de"],"X-Forwarded-Proto":["https"],"Dnt":["1"],"Sec-Gpc":["1"],"Referer":["https://switch2.mydomain.de/"],"Accept":["*/*"],"Sec-Fetch-Mode":["no-cors"],"X-Forwarded-For":["192.168.64.51"],"Via":["2.0 Caddy"],"Sec-Fetch-Dest":["script"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip, deflate, br, zstd"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"X-Content-Type-Options":["nosniff"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["text/html; charset=UTF-8"],"X-Xss-Protection":["1; mode=block"],"Set-Cookie":["REDACTED"],"Content-Length":["135"],"Cache-Control":["must-revalidate"],"Etag":["\"\""],"X-Frame-Options":["SAMEORIGIN"]},"status":404}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"upstream roundtrip","upstream":"192.168.64.8:80","duration":0.025174957,"request":{"remote_ip":"192.168.64.51","remote_port":"47992","client_ip":"192.168.64.51","proto":"HTTP/2.0","method":"GET","host":"switch2.mydomain.de","uri":"/","headers":{"X-Forwarded-Proto":["https"],"X-Forwarded-Host":["switch2.mydomain.de"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Dest":["document"],"Sec-Fetch-Mode":["navigate"],"Cookie":["REDACTED"],"Via":["2.0 Caddy"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64; rv:159.0) Gecko/20100101 Firefox/159.0"],"Sec-Fetch-Site":["none"],"Te":["trailers"],"Sec-Fetch-User":["?1"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Dnt":["1"],"Sec-Gpc":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Accept-Language":["de,en-US;q=0.9,en;q=0.8"],"X-Forwarded-For":["192.168.64.51"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"switch2.mydomain.de","ech":false}},"headers":{"Set-Cookie":["REDACTED"],"Date":["Tue, 28 Apr 2026 03:51:02"],"Content-Type":["text/html; charset=UTF-8"],"Cache-Control":["no-cache"],"X-Frame-Options":["SAMEORIGIN"],"X-Xss-Protection":["1; mode=block"],"X-Content-Type-Options":["nosniff"]},"status":200}
2026-10-30T17:54:31    Debug    caddy     "debug","ts":"2026-10-30T16:54:31Z","logger":"http.handlers.reverse_proxy","msg":"selected upstream","dial":"192.168.64.8:80","total_upstreams":1}


Ein ping auf die switche gibt folgendes aus

Code Select Expand

ping -c 3 switch1.mydomain.de
PING switch1.mydomain.de (MY.PUBLIC.WAN.IP) 56(84) bytes of data.
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=1 ttl=64 time=0.203 ms
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=2 ttl=64 time=0.199 ms
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=3 ttl=64 time=0.168 ms

--- switch1.mydomain.de ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2020ms
rtt min/avg/max/mdev = 0.168/0.190/0.203/0.015 ms

ping -c 3 switch2.mydomain.de
PING switch2.mydomain.de (MY.PUBLIC.WAN.IP) 56(84) bytes of data.
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=1 ttl=64 time=0.131 ms
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=2 ttl=64 time=0.177 ms
64 bytes from switch1.mydomain.de (MY.PUBLIC.WAN.IP): icmp_seq=3 ttl=64 time=0.203 ms

--- switch2.mydomain.de ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2085ms
rtt min/avg/max/mdev = 0.131/0.170/0.203/0.029 ms
Ich denke da liegt irgendwo der Fehler, denn warum wird bei einem ping auf switch2 die subdomain switch1 zurück gegeben?

nslookup sieht so aus

Code Select Expand

nslookup  switch1.mydomain.de
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   switch1.mydomain.de
Address: MY.PUBLIC.WAN.IP

nslookup  switch2.mydomain.de
Server:         127.0.0.53
Address:        127.0.0.53#53

Non-authoritative answer:
Name:   switch2.mydomain.de
Address: MY.PUBLIC.WAN.IP

Und traceroute kommt zu folgendem Ergebnis

Code Select Expand

traceroute  switch1.mydomain.de
traceroute to switch1.mydomain.de (MY.PUBLIC.WAN.IP), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
->

traceroute  switch2.mydomain.de
traceroute to switch2.mydomain.de (MY.PUBLIC.WAN.IP, 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  * * *
 7  * * *
 8  * * *
 9  * * *
10  * * *
11  * * *
12  * * *
13  * * *
14  * * *
15  * * *
->
Ich nutze caddy erst seit ein paar Tagen und bin da nicht der Experte. Für mich sieht so aus als wenn die Anfrage am WAN port ankommen und von caddy bearbeitet wirde, denn es kommt eine https Verbindung zustande. Es wird aber nur das Webinterface von switch1 angezeigt das von switch2 bleibt weiß. Irgendwie wird von caddy der request von switch2 nicht korrekt weitergeleitet, oder?

HAproxy ist unübersichtlich und ein Problem des Plugins ist, dass der maßgebliche Autor von der etablierten Terminologie von HAproxy abweicht und das ganze aufbaut wie viele Loadbalancer aus der kommerziellen Ecke - F5, Cisco, Kemp, ... - das Ganze behandeln.

Ich hab mir zugegebenermaßen nicht alle Details in diesem Thread angeguckt aber als generellen Hinweis:

Ich benutze für alle Dienste, die extern und intern erreichbar sein sollen, ausschließlich die externe IP-Adresse und FQDN. Nebst Letsencrypt-Zertifikat, natürlich. Also z.B. die Nextcloud heißt dann cloud.meinedomain.de - A und AAAA sind die WAN-Adresse meiner OPNsense und dort lauscht der Caddy und proxiet die Requests zum FreeBSD-Jail mit der Nextcloud.

Weshalb sollte ich für Zugriffe von "innen" eine andere IP-Adresse benutzen? Die Verbindung kommt zum LAN rein, dann ist "WAN address" eine lokale Adresse, also geht das an den Caddy. Da wird nix "erst mal raus zum Provider und dann wieder rein" geroutet. Jede Adresse, die für die Sense auf einem lokalen Interface liegt, ist gleichwertig. Und da ich auf LAN "allow LAN net to any" habe, geht das auch einfach so durch.

Keine NAT-Refelction, nix. Funktioniert einfach.

Es wäre einen winzigen Tick "optimaler", wenn cloud.meinedomain.de intern direkt auf den Server verweisen würde. Das würde den Proxy-Overhead sparen. Aber alle Server und die Sense sind hier intern mit 1G oder 10G veerknubbelt, also was soll das?

Pluspunkt: wenn es imtern funktioniert, weißt du, dass es auch extern funktioniert - und umgekehrt.

Das ist der Riesenvorteil eines Reverse-Proxy mit SSL-Terminierung im Proxy. Funktioniert von außen wie innen absolut identisch und es braucht keine NAT-Reflection oder anderes Gedöns.

Eine Verbindung von einem Client im "LAN" mit Ziel "WAN address" geht nicht "über das Internet". Nie. Berücksichtigen! 😉

Eine ähnliche Frage beschäftigt mich auch gerade, ich habe den Hinweis aus obigen post aufgenommen und dabei ist mir folgendes aufgefallen.

Auf meiner opnsense ist der ACME-Client und der caddy proxy eingerichtet, als lokalen DNS nutze ich unbound.
Caddy verteilt das Let's Encrypt Wildcard Zertifikat an die Dienste die in meinem Netz laufen, aber aus irgendeinem Grund nicht an alle. Z.B. habe ich 2 managed switche von DLink in meinem Netzwerk die ich über switch1.meinedomain.de und switch2.meinedomain.de anspreche.
Bei switch1 kommt eine https Verbindung zustande bei switch2 nicht obwohl die Subdomain und der Handler in caddy für beide switche genau gleich eingerichtet ist (außer der Upstream IP natürlich). Die Overrides in unbound sind so gesetzt dass die Dienste nach dem Muster subdomain.meinedomain.de an die öffentliche IP der WAN Schnittstelle weitergeleitet werden.
Und genauso verhält es sich auch mit anderen Diensten, bei manchen kommt eine ttps Verbindung zustande bei manchen nicht.

Hat jemand eine Idee woran das liegen könnte?

Thanks for the hint. I read the docs again and figured it out by myself :-).
Now the connection to a trunas instance is working and secured. Then I'tried to add a device like a managed switch, this connection is still unsecured.

Ok, I configured the domains and handlers from scratch.
When i call up myservice.maydomain.de the page is blank but the connection seems to be secured. At least firefox shows the shield on the left of the address bar.

The caddy log says

Code Select Expand

2026-10-25T08:29:12 Error caddy "error","ts":"2026-10-25T07:29:12Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"myservices","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:rejectedIdentifier - Invalid identifiers requested :: Cannot issue for \"myservices\": Domain name needs at least one dot"}
But where is a dot missing?

Cause it looks like the shared certificate config isn't attached to the subdomains you configured.

I used HAProxy for let's encrypt and Unbound for lokal DNS before. Might it be possible that lokal DNS with Unbound is not configured correctly in conjunction with caddy?

Thanks a lot for your reply,

The caddy domain looks like this
You cannot view this attachment.

The selected certificate is not Auto HTTPS of course, the certficate "mydomain.de (ACME Client)" is selected here.
You cannot view this attachment.
You cannot view this attachment.


The caddy handler
You cannot view this attachment.

My caddy log file

Code Select Expand

2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "info","ts":"2026-10-24T05:35:49Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:49 Error caddy "debug","ts":"2026-10-24T05:35:49Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "info","ts":"2026-10-24T05:35:12Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:12 Error caddy "debug","ts":"2026-10-24T05:35:12Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "info","ts":"2026-10-24T05:32:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:32:30 Error caddy "debug","ts":"2026-10-24T05:32:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:31:25 Warning caddy "warn","ts":"2026-10-24T05:31:25Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "info","ts":"2026-10-24T05:24:53Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:24:53 Error caddy "debug","ts":"2026-10-24T05:24:53Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:18:08 Warning caddy "info","ts":"2026-10-24T05:18:08Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Error caddy "debug","ts":"2026-10-24T05:18:08Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "info","ts":"2026-10-24T05:11:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:11:30 Error caddy "debug","ts":"2026-10-24T05:11:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "info","ts":"2026-10-24T05:03:24Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:24 Error caddy "debug","ts":"2026-10-24T05:03:24Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "info","ts":"2026-10-24T05:03:22Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:22 Error caddy "debug","ts":"2026-10-24T05:03:22Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "info","ts":"2026-10-24T05:01:41Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}



Unintentionally i posted the logfile twice, sorry for that.

Hi all,

I configured the ACME client on my opnsense to fetch a let's encrypt wildcard certificate. That works so far.

I have caddy installed to propagate this wildcard certificate for my services like nextcloud etc. I followed the instructions shown here
https://docs.opnsense.org/manual/how-tos/caddy.html#
For my wildcard domain (*.mydomain.de) i selected the corresponding certificate (mydomain.de (ACME Client)

I configured my services as subdomains as instructed here
https://docs.opnsense.org/manual/how-tos/caddy.html#wildcard-domain-with-subdomains

For local DNS I use Unbound.

When I call up the web page of my services the connection is not secured accompanied by the corresponding certificate warning.
To me it looks like caddy doesn't propagate the certificate, but i don't know why?

The caddy files look like this:

Caddyfile

Code Select Expand

# DO NOT EDIT THIS FILE -- OPNsense auto-generated file


# caddy_user=root

# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}

servers {
protocols h1 h2
}

email webmaster@mydomain.de
grace_period 10s
skip_install_trust
import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


*.mydomain.de {
tls /usr/local/etc/caddy/certificates/618398dcf287e.pem /usr/local/etc/caddy/certificates/618398dcf287e.key {
}
}

tnas.mydomain.de {
handle {
reverse_proxy https://192.168.64.21 {
}
}
}

wallbox.mydomain.de {
handle {
reverse_proxy https://192.168.65.245 {
transport http {
tls_insecure_skip_verify
}
}
}
}

import /usr/local/etc/caddy/caddy.d/*.conf

JSON Config

Code Select Expand

# DO NOT EDIT THIS FILE -- OPNsense auto-generated file


# caddy_user=root

# Global Options
{
log {
output net unixgram//var/run/caddy/log.sock {
}
format json {
time_format rfc3339
}
level DEBUG
}

servers {
protocols h1 h2
}

email webmaster@mydomain.de
grace_period 10s
skip_install_trust
import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


*.mydomain.de {
tls /usr/local/etc/caddy/certificates/618398dcf287e.pem /usr/local/etc/caddy/certificates/618398dcf287e.key {
}
}

tnas.mydomain.de {
handle {
reverse_proxy https://192.168.64.21 {
}
}
}

wallbox.mydomain.de {
handle {
reverse_proxy https://192.168.65.245 {
transport http {
tls_insecure_skip_verify
}
}
}
}

import /usr/local/etc/caddy/caddy.d/*.conf

My caddy log file

Code Select Expand

2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:49 Warning caddy "info","ts":"2026-10-24T05:35:49Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:49 Error caddy "debug","ts":"2026-10-24T05:35:49Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:49 Warning caddy "warn","ts":"2026-10-24T05:35:49Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:35:12 Warning caddy "info","ts":"2026-10-24T05:35:12Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:35:12 Error caddy "debug","ts":"2026-10-24T05:35:12Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:35:12 Warning caddy "warn","ts":"2026-10-24T05:35:12Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:32:30 Warning caddy "info","ts":"2026-10-24T05:32:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:32:30 Error caddy "debug","ts":"2026-10-24T05:32:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:32:30 Warning caddy "warn","ts":"2026-10-24T05:32:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:31:25 Warning caddy "warn","ts":"2026-10-24T05:31:25Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:24:53 Warning caddy "info","ts":"2026-10-24T05:24:53Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:24:53 Error caddy "debug","ts":"2026-10-24T05:24:53Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:24:53 Warning caddy "warn","ts":"2026-10-24T05:24:53Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:18:08 Warning caddy "info","ts":"2026-10-24T05:18:08Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:18:08 Error caddy "debug","ts":"2026-10-24T05:18:08Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:18:08 Warning caddy "warn","ts":"2026-10-24T05:18:08Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:11:30 Warning caddy "info","ts":"2026-10-24T05:11:30Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:11:30 Error caddy "debug","ts":"2026-10-24T05:11:30Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:11:30 Warning caddy "warn","ts":"2026-10-24T05:11:30Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:24 Warning caddy "info","ts":"2026-10-24T05:03:24Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:24 Error caddy "debug","ts":"2026-10-24T05:03:24Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.conf"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","msg":"No files matching import glob pattern","pattern":"/usr/local/etc/caddy/caddy.d/*.global"}
2026-10-24T07:03:24 Warning caddy "warn","ts":"2026-10-24T05:03:24Z","logger":"admin.api","msg":"exiting; byeee!! 👋"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:03:22 Warning caddy "info","ts":"2026-10-24T05:03:22Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}
2026-10-24T07:03:22 Error caddy "debug","ts":"2026-10-24T05:03:22Z","logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [mydomain.de *.mydomain.de]: no OCSP server specified in certificate"}
2026-10-24T07:03:22 Warning caddy "warn","ts":"2026-10-24T05:03:22Z","logger":"admin","msg":"admin endpoint on open interface; host checking disabled","address":"unix//var/run/caddy/caddy.sock|0220"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/3 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "warn","ts":"2026-10-24T05:01:41Z","logger":"http","msg":"HTTP/2 skipped because it requires TLS","network":"tcp","addr":":80"}
2026-10-24T07:01:41 Warning caddy "info","ts":"2026-10-24T05:01:41Z","logger":"pki.ca.local","msg":"root certificate trust store installation disabled; unconfigured clients may show warnings","path":"storage:pki/authorities/local/root.crt"}

Any ideas what could be wrong?

Network interfaces is set to "all", unbound should resolve addresses for the ovpn clients like for the LAN clients, right?

Unbound is running on my opnsense which has the IP 192.168.1.1
The IP values are for instance only!

OpenVPN is set as follows

Local Network: 192.168.1.0/24
DNS Servers: 192.168.1.1

With these values DNS is working for the LAN, but not for  the internet connection.

Do I have to set the IPs for the DNS Servers of my ISP as well?

Hi everyone,
i configured a OpenVPN instance according these guides.
https://docs.opnsense.org/manual/how-tos/sslvpn_instance_roadwarrior.html
https://www.zenarmor.com/docs/de/netzwerksicherheitstutorials/wie-richtet-man-openvpn-mit-mfa-auf-opnsense-ein

The connection works fine, the OpenVPN clients can connect to the internet and local hosts by IP address.

It would be great if the OpenVPN clients would be able to connect to local hosts by the domain name like nas.mydomain.de.
I use unbound as DNS for my local network.
If i set unbound DNS server as DNS in the configuration of the OpenVPN instance then it works, but the connection to the internet not anymore.

Any ideas to realize this?

Kind regards Pete

Thank you all for the infos provided, i will work through.
It's getting little complicated, more than I expeceted  :-\

To be honestly, I don't know. I checked the whole web ui, I can setup a DC but there's no possibiltiy to configure DNS.

I found some infos here
https://docs.nethserver.org/projects/ns8/en/latest/user_domains.html

Maybe that helps me to figure it out.

Ok, got it. I thought that I just can connect my TrueNAS to the AD running on the NethServer, I didn't know that in this case the NethServer must be the DNS as well.
It seems that Nethserver v8 doesn't support DNS, so I have to figure out a new concept how to realize it.
Maybe I try UCS instead of Nethserver 8.

Thanks for your help!