1. The problem I’m having:

I have recently setup Caddy with Let’s Encrypt and custom domain for my SSL needs, however facing weird delay before every page refresh when visiting a web app via iPhone. This is my setup:

Let’s Encrypt certs via DNS-01 (netcup)
OPNsense + Unbound for internal DNS (split-horizon, resolves fine)
Hosting a internal web app (e.g. Otterwiki) on a Debian LXC (Proxmox)

Problem: On my MDM-managed iPhone, reloading the page (even same page) most of the time results in 2 second delay before the page loads. The delay is always consistently 2 seconds. When accessing via MacBook there is no such issue and it’s lightning fast.

What I tested:

Direct IP to web app - no issues
Through Caddy over plain HTTP - no issues
SSL via Caddy’s internal ACME CA (step-ca, via hostname otter.home.arpa) - no issues, so it’s really the Let’s Encrypt DNS-01 path which is slow.
Disabled HTTP/3, iCloud Private Relay, IP tracking - same issue
Tried different browsers on iPhone - same issue
If I block all internet access from iPhone - same issue

The cert has a CRL distribution point (ye1.c.lencr.org), so could it be that my iPhone is doing a synchronous CRL fetch that times out/downloads on every new page hit (which is enforced by MDM)? However, I don’t see any requests going to Let’s Encrypt via Internet, so I am not sure.

Any ideas what it could be and how I could further troubleshoot this?

2. Error messages and/or full log output:

No errors present.

3. Caddy version:

v2.11.4

4. How I installed and ran Caddy:

Installed as a Systemd service on Debian 13.5 (trixie) using official instructions.

a. System environment:

Caddy is running as a Systemd service on Debian 13.5.

b. Command:

N/A

c. Service/unit/compose file:

PASTE OVER THIS HERE IN THIS CODE BLOCK.
Please ensure it looks nice.

d. My complete Caddy config:

{
	email redacted@pm.me
}

(homelab_tls) {
	tls {
		ca https://localhost:8443/acme/acme/directory
		ca_root /usr/local/share/ca-certificates/homelab-root.crt
	}
}

*.lab.custom.eu {
	tls {
		dns netcup {
			customer_number {env.NETCUP_CUSTOMER_NUMBER}
			api_key {env.NETCUP_API_KEY}
			api_password {env.NETCUP_API_PASSWORD}
		}
		propagation_delay 30s
		propagation_timeout 5m
		resolvers 1.1.1.1 8.8.8.8
	}

	@non_admin_not_media {
		not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24
		not host otter.lab.custom.eu
	}

	handle @non_admin_not_media {
		respond "Forbidden" 403
	}
	@otter host otter.lab.custom.eu
	handle @otter {
		reverse_proxy 192.168.20.93:8080
	}
	handle {
		respond "Unknown service" 404
	}
}

mylab.home.arpa {
	import homelab_tls

	# Only admin WireGuard peers may access Proxmox.
	@non_admin {
		not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24
	}
	handle @non_admin {
		respond "Forbidden" 403
	}
	handle {
		reverse_proxy https://192.168.10.10:8006 {
			transport http {
				tls_insecure_skip_verify
			}
		}
	}
}

5. Links to relevant resources:

N/A

Caddy Community - Latest posts

Message History

Delivery option(s)