Explain the internal working of CertMagic in Caddy?

CertMagic is the Go library, also written by the Caddy project, that gives Caddy its automatic HTTPS behavior. Caddy's TLS app is essentially a thin integration layer over CertMagic rather than a separate implementation.

Internally, CertMagic maintains a per-domain certificate cache in memory backed by the configured Storage interface (file system by default). For a domain that needs a certificate, it opens an ACME session with the configured CA (Let's Encrypt by default), and negotiates one of several supported challenge types depending on config: HTTP-01 (serves a token file over plain HTTP), TLS-ALPN-01 (proves control by responding to a special TLS handshake on port 443, useful when port 80 isn't available), or DNS-01 (creates a temporary DNS TXT record, required for wildcards).

Once the CA validates the challenge and issues the certificate, CertMagic writes it to storage, loads it into its in-memory cache, and registers it with Caddy's TLS layer so new TLS handshakes immediately use it. The same background maintenance loop that watches for expiring certificates also watches for corrupted or missing certificate files and re-issues automatically, which is what makes automatic HTTPS self-healing rather than a one-time setup step.