Automating SSL for Millions of Domains with Caddy
How our Rust control plane uses Caddy to instantly provision custom domain certificates for our managed tenants.
When a customer upgrades to the MarkReply Managed Cloud, they expect to serve their comment widget from their own subdomain (e.g., comments.their-startup.com).
Managing SSL certificates for thousands of custom, tenant-owned domains is one of the hardest infrastructure challenges in a multi-tenant SaaS. Here is how we solved it without ever restarting our web server.
📜 The Old Way: Nginx and Reloads
Historically, issuing a custom domain certificate required a fragile, multi-step pipeline:
- The tenant points their DNS to your server.
- A worker queue triggers Certbot to complete an ACME challenge.
- The server generates a new Nginx configuration file.
- The server forcefully reloads Nginx to apply the new certificate.
If a configuration is malformed, the reload fails, and routing breaks. If you have hundreds of signups an hour, constantly reloading the proxy creates dropped connections and latency spikes.
⚡ The MarkReply Way: Caddy On-Demand TLS
We bypassed this entirely by placing Caddy in front of our Rust Axum backend.
Caddy has a remarkable feature called On-Demand TLS. Instead of pre-fetching certificates when a user registers, Caddy waits until the very first time a browser attempts to visit comments.their-startup.com.
During the TLS handshake, Caddy pauses the connection and asks our Rust control plane a single question: “Is this domain authorized?”
// Caddy asks our Rust APIGET /api/internal/verify-domain?domain=comments.their-startup.comOur Axum backend instantly checks our SQLite database to verify if the tenant is on an active billing plan. If we return 200 OK, Caddy automatically:
- Generates an SSL certificate via Let’s Encrypt.
- Serves the certificate to the browser.
- Caches it securely for all future requests.
✋ Zero-Touch Provisioning
The entire process takes roughly 2 seconds for the very first visitor, and milliseconds for everyone else.
By combining Caddy’s dynamic proxying with our high-performance Rust control plane, we achieved true zero-touch provisioning. Customers can upgrade their plan, update their DNS, and immediately start securely serving comments—no manual intervention or server reloads required.