SSL Toolkit Logo
Tools Features Compare FAQ Login
Cd

PEM/PFX to Caddy Config

Convert your SSL certificate to a production-ready Caddy Caddyfile configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready Caddy Caddyfile configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

Caddy has built-in automatic HTTPS via Let's Encrypt. However, when using custom certificates, you need manual TLS configuration. The generated config includes tls block, protocols, ciphers, OCSP stapling, HSTS, and HTTP to HTTPS redirect.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate Caddy Config and copy or download the Caddyfile.

Use Cases

✓New Caddy server — Generate SSL config when deploying a new Caddy server.
✓Certificate renewal — Update Caddy config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get Caddy config with HSTS headers ready for preload submission.
✓PFX migration — Convert PFX certificate from IIS/Windows to Caddy format.
✓Security hardening — Apply Mozilla recommended cipher suites to Caddy.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •Caddy prefers PEM files for certificate and key. The tool generates both files automatically.
  • •Use the tls directive with cert and key paths for custom certificates.
  • •Reload Caddy after config changes: caddy reload
  • •Test config before reload: caddy validate
  • •Place cert and key in /etc/caddy/ with restrictive permissions.

Caddy SSL Directives Explained

tls

Path to the fullchain certificate and private key files. Use absolute paths or relative to Caddyfile.

protocols

Specifies allowed TLS versions. Modern: tls1.3. Intermediate: tls1.2 tls1.3.

ciphers

Comma-separated list of allowed cipher suites for handshake.

ocsp_stapling / strict_sni

Enables OCSP stapling and strict SNI matching for enhanced security.

Frequently Asked Questions

What files do I need for Caddy SSL?

Caddy requires two files: the fullchain certificate (tls cert.pem) and the private key (tls key.pem). Download these files from this tool.

How do I use custom certificates with Caddy?

Add tls /path/to/cert.pem /path/to/key.pem to your site block. Caddy will use these instead of automatic Let's Encrypt certificates.

How do I reload Caddy after changing SSL config?

Run caddy validate to check the config, then caddy reload to apply changes without downtime.

Related Tools

All Servers

Configs for all 6 servers
Ng

PEM to Nginx

Nginx server block config
Ap

PEM to Apache

Apache VirtualHost config

SSL Checker

Verify your Caddy config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites