Caddy can obtain and renew managed certificates without an operator manually implementing ACME. That removes repetitive work, not the prerequisites for issuance or the need to notice failures. A valid certificate today proves neither that the next renewal can complete nor that every TLS hop uses the same certificate. Identify the names, validation route, storage, and termination boundary first. ...
Build, publish, and check delivery while keeping artifact identity, sampled observations, and rollback distinct.
Start with a narrow policy, then expand it only when a documented feature needs another resource.
Test compressed and uncompressed requests separately so caches and validators describe the bytes actually served.
Use SNI, inspect the public certificate, and alert before renewal becomes an incident.
One root, one file_server, and a small header policy make a static deployment easy to inspect.