Yes and no. Usually you do HTTPS termination on the same device, so the traffic doesn't actually go out onto the network. To sniff it, you'd have to be root on the machine, in which case you're already compromised.
this post was submitted on 16 Sep 2025
9 points (100.0% liked)
Selfhosted
53408 readers
357 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
-
No low-effort posts. This is subjective and will largely be determined by the community member reports.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
There are multiple reasons but the most important one is: You didn't enable it.
Caddy fully supports https to the reverse proxy targets, though you'd have to get those targets trusted certificates otherwise caddy wouldn't connect.
The default protocol for backends is http, most of the time this isn't a problem because:
- The web server runs on the local machine
- The web server runs in containers/vms on the local machine
- or is running in a VM and has a direct virtual connection with the caddy vm
- The connection to the Backend is encrypted with a VPN
- Caddy and the web server are directly connected or connected through an otherwise isolated network
Because https requires certificates that are somewhat difficult to set up for internal servers (and were even harder to get before) the default mostly is just to encrypt on another layer of the stack. Afaik at least.
If you want everything on your local lan to have SSL, look into Step CA. Its not completely beginners friendly, but if you're serious about selfhosting you will manage to set it up :) Caddy works with it also, and their examples are very helpful.
Or simply create your rootCA, IntermediateCA, keys and certifictes with openSSL.
Neither of those are begginer friendly but openSSL is probably a bit easier to get started. There's a nice book with openSSL (if you are interested I migh look how it's called) and the last chapter is all about how to create your mini-CA and everthing else to serve your proxy with valid certificates for your homelab.
The reason i chose Step CA over openSSL is because with step CA you can automate certificate renewal without any manual intervention. I don't know how that would work with openSSL except some heavy scripting?
Yeah thats correct !
I Wouldn't say heavy though (maybe I see it that way because I got a bit better with bash and the like :p) because you can make use of CRL to revoke your certificates and renew them very easily with your intermediate and ready to use config files.
But yeah, there isn't any automated way to manage certificates like Smallstep does :)
You mentioned a book though... Now i'm curious ;-)
https://www.amazon.com/Demystifying-Cryptography-OpenSSL-3-0-techniques/dp/1800560346
It's really a good book :) And the last part is all about a mini-ca for your homelab !
However, don't use the ED448/ED25519 algorithm based certificates for TLS as mentioned in the example... They are still not supported by any browser !
If you can support the author, please do ! If you're on a budget, it's really easy to find in the piracy corner.
Thank you! I don’t mind buying books that are useful, work pays for that ;-)
If your concern is IoT devices, TVs, and the like sniffing on your local traffic, there are alternatives, and some of them are:
- https from reverse proxy to service.
- VLANs or Different LANs for IoT and your trusted devices (I do this one).
- Internal VPN connection between devices (like WireGuard), so the communication between selected devices is encrypted.