Backend HTTPS for Self-Signed Certificates

Backend HTTPS for Self-Signed Certificates

Some services only accept HTTPS connections using self-signed certificates. Backend HTTPS ensures Caddy connects to the backend via HTTPS without validating the certificate.

The Problem

Client  →  Caddy  →  http://10.8.0.3:5001  →  Backend rejects HTTP  ✕

The Solution

Client  →  Caddy (Let's Encrypt)  →  https://10.8.0.3:5001  →  Backend (Self-Signed)  ✓

Typical Services

Setup

1. Create or edit route
2. Enable Backend HTTPS toggle
3. Set Target Port to the HTTPS port (e.g. 5001)
4. Save

Important Notes

• Only enable when the backend enforces HTTPS
• insecure_skip_verify trusts any certificate — acceptable in VPN context
• Only available for HTTP routes
• With load balancing, all backends must support HTTPS