The release candidate for v2.2.0 - please try it out before the final release! As always, deploy into a test or staging environment before production.

Highlights:

• Replaced the old underlying ACME library (lego) with ACMEz - we now have full control over the entire certificate management stack! Config reloads will be faster and certificate management at scale will be smoother. The logs for cert operations is now consistent with Caddy's structured logs.
• Full support for a new ACME CA! ZeroSSL is an alternative CA to Let's Encrypt. Its ACME endpoint is free to use! To clarify, ZeroSSL's ACME endpoint is RFC 8555-compliant and was already compatible with Caddy; we just made it easier to use by automating the EAB credentials for your convenience. (Known issue: Must use RSA certificate keys for now. This is queued to be fixed by upstream service provider.)
• Fully customize certificate issuers from the Caddyfile. Up until now, you could only customize certain parts of the ACME issuer or choose the Internal issuer from the Caddyfile; now you have full control.
• Re-introduced HTTP/2 server push similar to how it was available in Caddy v1, but now a little better.
• ⚠️ The logfmt log encoder has been deprecated and will be removed. (It is already broken since it does not encode objects.)
• Customizable DNS resolver for reverse proxy.
• Numerous bug fixes and other enhancements!

Changelog

af5c148e admin,templates,core: Minor enhancements and error handling (#3607) 8a0fff58 caddyauth: hash-password: Set bcrypt cost to 14 (#3580) fb9d874f caddyfile: Export Tokenize function for lexing (#3549) 65a09524 caddyhttp: Add TLS client cert info to logs (#3640) 514eef33 caddyhttp: Add support to resolve DN in CEL expression (#3608) 6f0f159b caddyhttp: Add {http.request.body} placeholder 0bf2565c caddyhttp: Reorder some access log fields; add host matcher test case 66863aad caddytls: Add support for ZeroSSL; add Caddyfile support for issuers (#3633) efc0cc5e caddytls: Move initial storage clean op into goroutine 6a14e2c2 caddytls: Replace lego with acmez (#3621) 68529e2f cmd: Print caddy version with environ or --environ (#3627) 2ae8c119 fastcgi: Add resolve_root_symlink (#3587) 0665a86e fastcgi: Ensure leading slash, omit SERVER_PORT if empty for compliance (#3570) 3fdaf507 fastcgi: Fill REMOTE_USER with http.auth.user.id placeholder (#3577) 3860b235 fileserver: Don't assume len(str) == len(ToLower(str)) (fix #3623) 735c8665 fileserver: Enable browse pagination with offset parameter (#3542) c054a818 fileserver: Fix newly-introduced failing test on Linux (#3625) c42bfaf3 go.mod: Bump CertMagic 28d870c1 go.mod: Update quic-go, truststore, and goldmark c6d6a775 go.mod: Update some dependencies 2a5599e2 go.mod: Upgrade and downgrade smallstep, quic-go, and cpuid 6f73a358 httpcaddyfile: Add compression to http transport config (#3624) 584eba94 httpcaddyfile: Allow named matchers in route blocks (#3632) ff19bdda httpcaddyfile: Avoid repeated subjects in APs (fix #3618) 8b80a320 httpcaddyfile: Bring enforce_origin and origins to admin config (#3595) 7bfe5b6c httpcaddyfile: Reorder automation policy logic (close #3550) eda54c22 logging: ⚠️ Deprecate logfmt encoder 6cea1f23 push: Implement HTTP/2 server push (#3573) 904f149e reverse_proxy: fix bidirectional streams with encodings (fix #3606) (#3620) e9b1d7dc reverse_proxy: flush HTTP/2 response when ContentLength is unknown (#3561) 19cc2bd3 reverseproxy: Fix Caddyfile parsing for empty non-http transports (#3576) e2f913bb reverseproxy: Minor fixes and cleanup 246a31aa reverseproxy: Restore request's original host and header (fix #3509) bd9d796e reverseproxy: add support for custom DNS resolver (#3479) c3582001 templates: Disable hard wraps in Markdown rendering (#3553) a2dae1d4 templates: Fix front matter closing fence search 2bc30bb7 templates: Implement placeholders function (#3324)