Add short-lived SSL support for IP addresses and other Let's Encrypt profiles

- Added details on using Let's Encrypt short-lived certificates and the `CADDY_ACME_PROFILE` environment variable in the documentation.
- Updated the Dockerfile to set the default value for `CADDY_ACME_PROFILE` to "off".
- Modified the Caddyfile to include the option for selecting a Let's Encrypt ACME certificate profile.

These changes improve clarity on SSL options and enhance the configuration flexibility for users.

Author: jaydrogers

docs/content/docs/2.image-variations/frankenphp.md

@@ -304,6 +304,8 @@ services:
 Automatic HTTPS requires a public domain name and ports 80/443 accessible from the internet for Let's Encrypt validation. For local development, use self-signed certificates with `SSL_MODE`.
 ::
 
+Need Let's Encrypt short-lived certificates or IP-address certificates? Set `CADDY_ACME_PROFILE: "shortlived"`. See [Short-lived & IP-address certificates](/docs/deployment-and-production/configuring-ssl#short-lived--ip-address-certificates) for the trade-offs and the `default_sni` setup for SNI-less access.
+
 ### SSL Modes for Development
 For local development, use the `SSL_MODE` environment variable:
 
@@ -339,6 +341,7 @@ The FrankenPHP variation supports extensive customization through environment va
 | `FRANKENPHP_CONFIG` | `""` | FrankenPHP-specific configuration (e.g., worker mode) |
 | `CADDY_SERVER_ROOT` | `/var/www/html/public` | Document root for the application |
 | `CADDY_AUTO_HTTPS` | `off` | Enable automatic HTTPS (`on`/`off`) |
+| `CADDY_ACME_PROFILE` | `off` | Let's Encrypt certificate profile: `off`, `shortlived`, `tlsserver`, or `classic` |
 | `CADDY_HTTP_PORT` | `8080` | HTTP port |
 | `CADDY_HTTPS_PORT` | `8443` | HTTPS port |
 | `CADDY_ADMIN` | `off` | Caddy admin API endpoint |

docs/content/docs/4.deployment-and-production/4.configuring-ssl.md

@@ -150,6 +150,30 @@ phpinfo();
 You can achieve zero-downtime deployments with FrankenPHP by placing a reverse proxy in front of the container.
 ::
 
+#### Short-lived & IP-address certificates
+Let's Encrypt offers a [`shortlived` certificate profile](https://letsencrypt.org/docs/profiles/){target="_blank"} that issues ~6-day certificates. Because they expire so quickly, they don't rely on revocation (OCSP/CRL). This same profile is also **required** for [IP-address certificates](https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability){target="_blank"}.
+
+Enable it with the `CADDY_ACME_PROFILE` environment variable:
+
+| Variable  | Expected Value | Description |
+|----------|----------------|----------------|
+| `CADDY_ACME_PROFILE` <br />*Default: "off"* | `shortlived` | Select a Let's Encrypt certificate profile. Also accepts `tlsserver` and `classic`. |
+
+::warning
+Enabling a profile configures Caddy's `cert_issuer`, which pins issuance to **Let's Encrypt only** (the default ZeroSSL fallback is dropped). Short-lived certificates also renew roughly every 2 days, so the container needs reliable egress to the ACME CA. Leave it `off` unless you specifically want this behavior.
+::
+
+**Raw-IP / SNI-less access:** clients connecting by IP address send no SNI, so Caddy needs a [`default_sni`](https://caddyserver.com/docs/caddyfile/options#default-sni){target="_blank"} to know which certificate to serve. There's no dedicated variable for this because the value is your own domain/IP — set it through `CADDY_GLOBAL_OPTIONS`:
+
+```yml
+environment:
+  CADDY_AUTO_HTTPS: "on"
+  CADDY_ACME_PROFILE: "shortlived"
+  # Fallback identity for connections that send no SNI (e.g. by IP).
+  # Reference your own variable if you like: "default_sni {$APP_DOMAIN}"
+  CADDY_GLOBAL_OPTIONS: "default_sni example.com"
+```
+
 ### Bringing Your Own Certificate
 If automatic HTTPS isn't an option, you can provide your own certificate from a vendor like [ssls.com](https://www.ssls.com/){target="_blank"}. Ensure your certificate issuer provides certificates compatible with your web server in [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail){target="_blank"}.
 

docs/content/docs/8.reference/1.environment-variable-specification.md

@@ -45,6 +45,7 @@ Setting environment variables all depends on what method you're using to run you
 `AUTORUN_LARAVEL_SKIP_IF_NOT_FOUND`<br />*Default: "false"*|When set to `true`, the Laravel Automations script will exit gracefully (without error) if Laravel is not detected in `APP_BASE_DIR`, instead of failing the container. Useful when `AUTORUN_ENABLED=true` is set on a shared image where Laravel may not always be present (e.g. before the first `composer install`). <br />ℹ️ Requires `AUTORUN_ENABLED = true` to have any effect.| all
 `AUTORUN_LARAVEL_STORAGE_LINK`<br />*Default: "true"*|Automatically run "php artisan storage:link" on container start. <br />ℹ️ Requires `AUTORUN_ENABLED = true` to run.| all
 `AUTORUN_LARAVEL_VIEW_CACHE`<br />*Default: "true"*|Automatically run "php artisan view:cache" on container start. <br />ℹ️ Requires `AUTORUN_ENABLED = true` to run.| all
+`CADDY_ACME_PROFILE`<br />*Default: "off"*|Select a Let's Encrypt ACME certificate profile. Valid options: `off` (default, no profile — keeps the stock Let's Encrypt + ZeroSSL issuers), `shortlived` (~6-day certs; also required for IP-address certificates), `tlsserver`, or `classic`. Setting any profile pins issuance to Let's Encrypt only and renews more frequently, so the container needs reliable egress to the ACME CA. (<a target="_blank" href="https://letsencrypt.org/docs/profiles/">Official docs</a>)|frankenphp
 `CADDY_ADMIN`<br />*Default: "off"*|Enable Caddy admin interface. (<a target="_blank" href="https://caddyserver.com/docs/caddyfile/options#admin">Official docs</a>)|frankenphp
 `CADDY_AUTO_HTTPS`<br />*Default: "off"*|Enable automatic HTTPS. (<a target="_blank" href="https://caddyserver.com/docs/caddyfile/options#auto-https">Official docs</a>)|frankenphp
 `CADDY_GLOBAL_OPTIONS`<br />*Default: ""*|Set global options for the Caddy server. (<a target="_blank" href="https://caddyserver.com/docs/caddyfile/options">Official docs</a>)|frankenphp

src/variations/frankenphp/Dockerfile

@@ -127,6 +127,7 @@ LABEL org.opencontainers.image.title="serversideup/php (frankenphp)" \
     org.opencontainers.image.licenses="GPL-3.0-or-later"
 
     ENV APP_BASE_DIR=/var/www/html \
+    CADDY_ACME_PROFILE="off" \
     CADDY_ADMIN="off" \
     CADDY_AUTO_HTTPS="off" \
     CADDY_GLOBAL_OPTIONS="" \

src/variations/frankenphp/etc/frankenphp/Caddyfile

@@ -19,8 +19,11 @@
 
 	import trusted-proxy/{$TRUSTED_PROXY:cloudflare}.caddyfile
 
+	# Select a Let's Encrypt ACME certificate profile (default: off)
+	import acme-profile/{$CADDY_ACME_PROFILE:off}.caddyfile
+
 	# Add additional Caddy configuration files from the caddyfile-global.d directory
-	import caddyfile-global.d/*.caddyfile 
+	import caddyfile-global.d/*.caddyfile
 
 	{$CADDY_GLOBAL_OPTIONS}
 }

src/variations/frankenphp/etc/frankenphp/acme-profile/classic.caddyfile

@@ -0,0 +1,7 @@
+# Request Let's Encrypt's "classic" certificate profile.
+#
+# Note: configuring cert_issuer pins issuance to Let's Encrypt only (this
+# drops the default ZeroSSL fallback).
+cert_issuer acme {
+	profile classic
+}

src/variations/frankenphp/etc/frankenphp/acme-profile/off.caddyfile

@@ -0,0 +1,5 @@
+# No ACME certificate profile is configured (default).
+#
+# Caddy keeps its stock issuer behavior, including the automatic
+# Let's Encrypt + ZeroSSL fallback. Set CADDY_ACME_PROFILE to select a
+# specific Let's Encrypt certificate profile instead.

src/variations/frankenphp/etc/frankenphp/acme-profile/shortlived.caddyfile

@@ -0,0 +1,12 @@
+# Request Let's Encrypt's "shortlived" certificate profile (~6-day certs).
+#
+# Note: configuring cert_issuer pins issuance to Let's Encrypt only (this
+# drops the default ZeroSSL fallback). Short-lived certs renew roughly every
+# 2 days, so the container needs reliable egress to the ACME CA.
+#
+# The shortlived profile is also required for IP-address certificates. For
+# raw-IP / SNI-less access, also set a default SNI via CADDY_GLOBAL_OPTIONS,
+# e.g. CADDY_GLOBAL_OPTIONS="default_sni {$APP_DOMAIN}".
+cert_issuer acme {
+	profile shortlived
+}

src/variations/frankenphp/etc/frankenphp/acme-profile/tlsserver.caddyfile

@@ -0,0 +1,7 @@
+# Request Let's Encrypt's "tlsserver" certificate profile.
+#
+# Note: configuring cert_issuer pins issuance to Let's Encrypt only (this
+# drops the default ZeroSSL fallback).
+cert_issuer acme {
+	profile tlsserver
+}