Web / Caddy Server Interview questions
How does Caddy handle automatic certificate renewal?
Caddy tracks the expiration date of every certificate it manages and renews each one well before it lapses, without any cron job or external scheduler.
Internally, the CertMagic library runs a background maintenance routine that periodically checks each managed certificate. Once a certificate is within roughly 30 days (about a third of its 90-day Let's Encrypt lifetime) of expiring, Caddy starts a new ACME transaction to obtain a fresh certificate, using the same challenge type as the original issuance.
The new certificate is installed in place and the old one is retired, all without an operator restarting the process. If renewal fails - due to DNS problems, rate limits, or an unreachable challenge - Caddy logs the failure and keeps retrying with backoff, continuing to serve the still-valid existing certificate until either renewal succeeds or the certificate actually expires.
More Related questions...
