Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/fuomag9/caddy-proxy-manager/llms.txt

Use this file to discover all available pages before exploring further.

The certificates API covers three related areas: TLS certificates used by proxy hosts, the built-in CA for mutual TLS, and client certificate management. DNS provider credentials — used for DNS-01 ACME challenges — are also managed here.

​
TLS certificate endpoints

MethodPathDescription
GET/api/v1/certificatesList all certificates
POST/api/v1/certificatesImport a custom certificate
GET/api/v1/certificates/{id}Get certificate details
PUT/api/v1/certificates/{id}Update a certificate
DELETE/api/v1/certificates/{id}Delete a certificate

​
Import a custom certificate

POST /api/v1/certificates 
curl -X POST https://your-instance:3000/api/v1/certificates \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Custom Cert",
    "certificate": "-----BEGIN CERTIFICATE-----\n...",
    "privateKey": "-----BEGIN PRIVATE KEY-----\n..."
  }'
​
name
string
required
Display name for the certificate.
​
certificate
string
required
PEM-encoded certificate (and any intermediate chain).
​
privateKey
string
required
PEM-encoded private key. Stored unencrypted in the SQLite database.

​
CA certificate endpoints

MethodPathDescription
GET/api/v1/ca-certificatesList CA certificates
POST/api/v1/ca-certificatesCreate a CA certificate
DELETE/api/v1/ca-certificates/{id}Delete a CA certificate

​
Client certificate endpoints

These endpoints manage mTLS client certificates issued by CPM’s built-in CA.
MethodPathDescription
GET/api/v1/client-certificatesList issued client certificates
POST/api/v1/client-certificatesIssue a new client certificate
POST/api/v1/client-certificates/{id}/revokeRevoke a client certificate
DELETE/api/v1/client-certificates/{id}Delete a client certificate record

​
Issue a client certificate

POST /api/v1/client-certificates 
curl -X POST https://your-instance:3000/api/v1/client-certificates \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "alice-laptop",
    "expiresAt": "2026-01-01T00:00:00.000Z"
  }'
The response includes the PEM-encoded certificate and private key. Store the private key immediately — it is not stored by CPM and cannot be retrieved again.

​
DNS provider endpoints

MethodPathDescription
GET/api/v1/dns-providersList configured DNS providers
POST/api/v1/dns-providersAdd a DNS provider
PUT/api/v1/dns-providers/{id}Update a DNS provider
DELETE/api/v1/dns-providers/{id}Remove a DNS provider
DNS provider credentials are encrypted at rest with AES-256-GCM and are never returned in plain text via the API.

​
mTLS role endpoints

MethodPathDescription
GET/api/v1/mtls-rolesList mTLS roles
POST/api/v1/mtls-rolesCreate an mTLS role
PUT/api/v1/mtls-roles/{id}Update an mTLS role
DELETE/api/v1/mtls-roles/{id}Delete an mTLS role

Build docs developers (and LLMs) love

Get started for freeTalk to us