- Nearly every part of the config that "does something" is pluggable. Caddy offers so much in such a lean package.
+ Nearly every part of the config that "does something" is pluggable. Caddy offers unlimited capabilities in such a lean package.
diff --git a/new/on-demand-tls.html b/new/on-demand-tls.html
new file mode 100644
index 0000000..305b69c
--- /dev/null
+++ b/new/on-demand-tls.html
@@ -0,0 +1,149 @@
+
+
+
+ Caddy is the best web server for HTTPS
+ {{include "/includes/head.html"}}
+
+
+
+
+
+
+ ... a dynamically-provisioned TLS certificate by Caddy!
+
+
+
+
+
+
+
+
+
+
+
+ What happened?
+
+
+ Caddy automatically obtained a certificate for your domain, {{.Req.Host}}, without any change to the server's configuration. We call this technology On-Demand TLS, and it's an exclusive feature of Caddy.
+
+
+ With On-Demand TLS, no config changes are required to serve more domains over HTTPS. This is perfect for servers hosting content or APIs for customer-owned domains because your HTTPS deployment scales as tall and wide as your business does.
+
+
+ Caddy's technology is the secret sauce of many SaaS products that offer custom domains. It generates hundreds of thousands of dollars in revenue every year while saving businesses tens of thousands of dollars in development and maintenance costs.
+
+
+ Fun fact: this feature earned standing ovations at more than one tech demo back in 2015 and 2016 when it was first introduced.
+
+
+
+
+
+
+
+ Easy, self-hosted HTTPS for customer domains
+
+
+ Use On-Demand TLS to grow your custom-domain SaaS business in a matter of minutes. A minimal config looks like this:
+
+
+
+
+
+
1. Prevent abuse
+
+ First, you'll configure an internal endpoint that Caddy can "ask" if a certificate should be allowed for a domain. This endpoint usually looks up the domain in a list or database and returns HTTP 200 if it's allowed.
+
+
+
+
2. Enable On-Demand TLS
+
+ To finish, enable On-Demand TLS for a catch-all site.
+
+ Actual production configs typically have more, but this is the minimal configuration needed to serve domain names that aren't in your control. All that's left is for the domain owner to set their DNS records (described below).
+
+
+
+
+
+
+
+
+
+ Brilliant customer experience
+
+
+ For domain owners, the flow is even simpler: set DNS records. The first visit to their site will provision a TLS certificate. Works like magic!
+
+
+
+
+
+
1. Point DNS records
+
+ The owner of the domain sets A and/or AAAA records to point to your Caddy instance.
+
+
+
+
+
+
+ # Examples shown. In real life, users
+# point domains to your IP address.
+
+A -> 203.0.113.42
+
+AAAA -> 2001:db8:900d:1337
+
+
+
+
+
+
+ There is no step 2. Caddy will obtain and serve a certificate for their domain as soon as a connection is made to it. Caddy keeps the certificates renewed as long as connections keep coming in. Once they stop, Caddy will let the certificate expire and then delete it automatically.
+
+ 
@@ -222,7 +222,7 @@