Caddy 2.3 beta 1 is the first pre-release for Caddy 2.3! Please help test it in appropriate staging/test environments, and low-risk production environments. Major features and improvements include:

• Multi-issuer support. Caddy can now get certificates from multiple issuers for redundancy; if one fails, another will be tried. Caddy's new defaults are Let's Encrypt and ZeroSSL. Caddy is the first web server to support multiple issuers, offering unrivaled reliability for your site's HTTPS. It is the first ACME client to support multiple CA fallbacks.

• Improved on-demand TLS. On-demand TLS is where certificate obtain/renew operations are triggered on a TLS handshake that requires them. We've moved a lot of the processing to the background where possible (e.g. when an existing certificate is still usable) so more connections will finish their handshakes faster, and fewer handshakes will fail (however, you still need to watch the logs and fix the errors before it's too late).

• Support for alternate certificate chains. You can now customize which certificate chains to download from ACME servers that offer more than one.

• New map handler is ready for production use. It's been in Caddy for a few versions now but it's finally ready for production, with enhanced efficiency and functionality. It will be added to the documentation shortly. We have been using this handler with a customer in production for a while now, on an instance that is handling thousands of sites.

• Customize servers and listeners with the Caddyfile. The Caddyfile structure is oriented around sites for convenience, so customizing servers has not been possible until now. You can now use global options to configure servers and their listeners (for example, protocol options, socket read options, and more) without having to use JSON config.

This release also contains numerous bug fixes and other enhancements. Please help test it and report any issues with as much detail and simplification as you can, thank you!

This release is the work of at least 16 contributors.

Changelog

c5197f59 acme_server: fix reload of acme database (#3874) 06ba006f acme_server: switch to bbolt storage (#3868) 7a3d9d81 basicauth: Minor internal improvements (#3861) 937ec342 caddyauth: Prevent user enumeration by timing c6dec305 caddyfile: Add support for env var defaults; add tests (#3682) 4fc57071 caddyhttp: Fix header matcher when using nil 966d5e6b caddyhttp: Merge header matchers in Caddyfile (#3832) b4f49e29 caddyhttp: Merge query matchers in Caddyfile (#3839) 1438e4db caddyhttp: New idle_timeout default of 5m 349457cc caddyhttp: Return error if error handling error b0f8fc7a caddytls: Configure trusted CAs from PEM files (#3882) 95af4262 caddytls: Support ACME alt cert chain preferences 13781e67 caddytls: Support multiple issuers (#3862) eda9a1b3 fastcgi: Add timeouts support to Caddyfile adapter (#3842) 7d7434c9 fileserver: Add debug logging 8d038ca5 fileserver: Improve and clarify file hiding logic (#3844) 0a7721dc fileserver: Preserve transformed root (fix #3838) b6e96d6f go.mod: Update CertMagic 1e480b81 go.mod: update quic-go to v0.19.2 (#3880) a26f70a1 headers: Fix Caddyfile parsing with request matcher (#3892) b0d5c2c8 headers: Support default header values in Caddyfile with '?' (#3807) 7c28ecb5 httpcaddyfile: Add certificate_pem placeholder short, add to godoc (#3846) 3cfefeb0 httpcaddyfile: Configure servers via global options (#3836) 03d853e2 httpcaddyfile: Fix test on Windows b6686a54 httpcaddyfile: Improve AP logic with OnDemand 63afffc2 httpcaddyfile: Proper log config with catch-all blocks (fix #3878) db4f1c02 httpcaddyfile: Revise automation policy generation (#3824) dd26875f logging: Fix for IP filtering 670b723e requestbody: Add Caddyfile support (#3859) 99b8f444 reverse_proxy: Fix random_choose selection policy (#3811) 4a641f6c reverseproxy: Add Caddyfile scheme shorthand for h2c (#3629) b6609937 reverseproxy: Add max_idle_conns_per_host; fix godocs (#3829) 53aa60af reverseproxy: Handle "operation was canceled" errors (#3816) 6e0849d4 reverseproxy: Implement cookie hash selection policy (#3809) 96058538 reverseproxy: Logging for streaming and upgrades (#3689) 860cc6ad reverseproxy: Wire up some http transport options in Caddyfile (#3843) c9fdff99 reverseproxy: caddyfile: Don't add port if upstream has placeholder (#3819) 6ea6f3eb reverseproxy: fix random hangs on http/2 requests with server push (#3875)