Caddy and TLS on OpenBSD

Since I want https to work properly on my local network I need to allow caddy to manage TLS certificates for me. There are two options, either I configure caddy to use lets-encrypt to get real trusted certificates so I don’t have to deal with browsers telling me that “this certificate isn’t trusted” or I just let caddy create it’s own certificates and I have to add exceptions (or import the root certificate) on all my client browsers. At first I just went with the second option as it was quicker to get up and running, but that was always meant to be temporary as the user experience of needing to install certificates everywhere is annoying. In order to get caddy to provide actual certificates, I need to configure it to respond to Acme challenges. Per the caddy docs there are two ways to do this: HTTP/TLS-ALPN challenge - this requires that my caddy instance be reachable over the public internet, which is not something I’d like to do since it’s an internal service for internal clients.…