Own server (Caddy)

Before it does, it asks JustDocs whether that domain is allowed; only domains whose ownership record has been confirmed are, so nobody can make your server request certificates for random domains.

1. Move Apache or Nginx off ports 80 and 443, for example to 127.0.0.1:8080. Keep the App URL as https://your-domain.example; JustDocs trusts the forwarded headers Caddy sends.
2. Install Caddy and make sure ports 80 and 443 reach it from the internet. Let's Encrypt needs both.
3. In Admin → Settings → Custom domains, choose Own server (Caddy). The page shows the exact ask line with your check key.
4. Put this in /etc/caddy/Caddyfile, with your own domain, email and ask line:

{
	email you@your-domain.example

	on_demand_tls {
		ask https://your-domain.example/__domains/allowed?key=YOUR_CHECK_KEY
	}
}

# Your platform: a normal certificate.
your-domain.example {
	reverse_proxy 127.0.0.1:8080
}

# Customers' domains: a certificate on first visit, for allowed domains only.
https:// {
	tls {
		on_demand
	}
	reverse_proxy 127.0.0.1:8080
}

http:// {
	redir https://{host}{uri} permanent
}

Then run sudo systemctl reload caddy. When a customer's DNS is right, their domain goes from Getting certificate to Live, usually within a minute. If it stays stuck, the customer is asked to check that ports 80 and 443 reach your server and that no CAA record on their domain blocks Let's Encrypt. If you make a new check key, update the ask line and reload Caddy.