2s Delay when loading pages (Let's Encrypt with DNS-01 challenge) - Help - Caddy Community = 40rem)" rel="stylesheet" data-target="chat_desktop" /> = 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /> = 40rem)" rel="stylesheet" data-target="poll_desktop" /> = 40rem)" rel="stylesheet" data-target="desktop_theme" data-theme-id="1" data-theme-name="caddy custom"/> 2s Delay when loading pages (Let's Encrypt with DNS-01 challenge) Help lanceolate (T) August 16, 2026, 12:53pm 1 1. The problem I’m having: I have recently setup Caddy with Let’s Encrypt and custom domain for my SSL needs, however facing weird delay before every page refresh when visiting a web app via iPhone. This is my setup: Let’s Encrypt certs via DNS-01 (netcup) OPNsense + Unbound for internal DNS (split-horizon, resolves fine) Hosting a internal web app (e.g. Otterwiki) on a Debian LXC (Proxmox) Problem: On my MDM-managed iPhone, reloading the page (even same page) most of the time results in 2 second delay before the page loads. The delay is always consistently 2 seconds. When accessing via MacBook there is no such issue and it’s lightning fast. What I tested: Direct IP to web app - no issues Through Caddy over plain HTTP - no issues SSL via Caddy’s internal ACME CA (step-ca, via hostname otter.home.arpa) - no issues, so it’s really the Let’s Encrypt DNS-01 path which is slow. Disabled HTTP/3, iCloud Private Relay, IP tracking - same issue Tried different browsers on iPhone - same issue If I block all internet access from iPhone - same issue The cert has a CRL distribution point (ye1.c.lencr.org), so could it be that my iPhone is doing a synchronous CRL fetch that times out/downloads on every new page hit (which is enforced by MDM)? However, I don’t see any requests going to Let’s Encrypt via Internet, so I am not sure. Any ideas what it could be and how I could further troubleshoot this? 2. Error messages and/or full log output: No errors present. 3. Caddy version: v2.11.4 4. How I installed and ran Caddy: Installed as a Systemd service on Debian 13.5 (trixie) using official instructions. a. System environment: Caddy is running as a Systemd service on Debian 13.5. b. Command: N/A c. Service/unit/compose file: PASTE OVER THIS HERE IN THIS CODE BLOCK. Please ensure it looks nice. d. My complete Caddy config: { email [email protected] } (homelab_tls) { tls { ca https://localhost:8443/acme/acme/directory ca_root /usr/local/share/ca-certificates/homelab-root.crt } } *.lab.custom.eu { tls { dns netcup { customer_number {env.NETCUP_CUSTOMER_NUMBER} api_key {env.NETCUP_API_KEY} api_password {env.NETCUP_API_PASSWORD} } propagation_delay 30s propagation_timeout 5m resolvers 1.1.1.1 8.8.8.8 } @non_admin_not_media { not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24 not host otter.lab.custom.eu } handle @non_admin_not_media { respond "Forbidden" 403 } @otter host otter.lab.custom.eu handle @otter { reverse_proxy 192.168.20.93:8080 } handle { respond "Unknown service" 404 } } mylab.home.arpa { import homelab_tls # Only admin WireGuard peers may access Proxmox. @non_admin { not remote_ip 10.9.8.2 10.9.8.3 192.168.20.0/24 } handle @non_admin { respond "Forbidden" 403 } handle { reverse_proxy https://192.168.10.10:8006 { transport http { tls_insecure_skip_verify } } } } 5. Links to relevant resources: N/A Bruce5051 (Bruce) August 16, 2026, 6:25pm 2 But to get a certificate via DNS-01 there is no connection made to the website server, only to the DNS servers. Once the certificate has been issued and obtained and deployed it should behave no differently than any other certificate.