How do you troubleshoot Caddy certificate issues?

Certificate problems in Caddy almost always trace back to one of a small set of causes, so working through them in order usually finds the issue quickly.

1. Check the logs - run journalctl -u caddy -f or read the configured log output for ACME error messages, which usually name the exact failure.
2. Confirm DNS resolves correctly - the domain in your site block must resolve, publicly, to this server's IP for HTTP-01 challenges to succeed.
3. Verify ports 80 and 443 are reachable - firewalls, security groups, or another process already bound to those ports will block ACME validation.
4. Watch for rate limits - Let's Encrypt limits certificates per domain per week; repeated failed test reloads can trigger this, in which case switching to the staging CA temporarily helps.
5. Check the storage path - if /data (or your configured storage directory) isn't writable, Caddy can't persist the issued certificate.

For wildcard certificates specifically, confirm the DNS provider plugin and API credentials are correct, since wildcards require a DNS-01 challenge rather than HTTP-01.