Overview
Pick Caddy for new single-server and small-team deployments that want automatic certificates; pick nginx when you need its modules, detailed tuning, or already run it well. As of 2026-10-01 nginx mainline is 1.31 (1.31.6 on 2026-09-15). Caddy provisions and renews certificates through ACME (Let’s Encrypt and ZeroSSL) by default and enables HTTP/3 by default. nginx open source does not manage certificates itself, but a separate Apache-2.0 nginx-acme module (Rust, requires nginx 1.22+) adds ACMEv2 with HTTP-01 and TLS-ALPN-01.
Comparison
| Dimension | Caddy | nginx |
|---|---|---|
| HTTPS certificates | Automatic by default | Certbot or another ACME client, or the nginx-acme module |
| HTTP/3 | On by default | ngx_http_v3_module, not built by default, documented as experimental; needs --with-http_v3_module and listen ... quic |
| Config | Caddyfile, native JSON, live config API | nginx.conf blocks; reload with nginx -s reload |
| Extensibility | Go plugins compiled in with xcaddy | C dynamic modules; large third-party catalog (ModSecurity, OpenResty/Lua) |
| Tuning detail | Sensible defaults; fewer knobs | Extensive, with years of published guidance |
| Kubernetes | Not a standard ingress choice | The community ingress-nginx controller was retired in March 2026; use Gateway API or another maintained controller |
| License | Apache 2.0 | BSD-2-Clause; F5 sells NGINX Plus |
Pick Caddy when
Pick Caddy when setup time and certificate hygiene matter.
- A VPS or container serving a reverse proxy or static site; a Caddyfile with a hostname and
reverse_proxygets HTTPS with no cron job. - Teams without nginx experience, and services that change upstreams through the admin API.
- HTTP/3 without a custom build.
app.example.com {
reverse_proxy 127.0.0.1:3000
}Pick nginx when
Pick nginx when modules, tuning, or compatibility dominate.
- WAF with ModSecurity, Lua scripting with OpenResty, or other C modules.
- Established runbooks, configuration management, and hiring familiarity.
- Fine-grained control over buffering, caching, and upstream behavior at high concurrency.
- Behind a CDN that already terminates TLS, where automatic certificates add little.
- If you need HTTP/3 on nginx, verify your build includes the module and read the experimental notice; versions 1.29.2 to 1.31.5 had a buffer overflow in it, fixed in 1.31.6 and 1.30.5.
Migrate
nginx to Caddy: translate each server block to a site block; location becomes handle or route. Lua and ModSecurity need replacements, for example moving the WAF to Cloudflare (cloudflare). Caddy to nginx: write server blocks and add an ACME client. Verify redirects, canonical hosts, and HSTS match before switching DNS; see technical. For Kubernetes clusters still on the retired ingress-nginx, plan the move to Gateway API; existing installs keep working but no longer receive fixes.
FAQ
Does nginx support automatic HTTPS like Caddy?
Not by default; nginx needs Certbot or another ACME client, or the separate Apache-2.0 nginx-acme module (requires nginx 1.22 and later). Caddy provisions and renews certificates through Let’s Encrypt and ZeroSSL automatically.
Does nginx support HTTP/3?
Yes through ngx_http_v3_module, which is not built by default and is documented as experimental. Versions 1.29.2 to 1.31.5 had a buffer overflow in it, fixed in 1.31.6 and 1.30.5; Caddy enables HTTP/3 by default.
What should I use instead of ingress-nginx?
The community ingress-nginx controller was retired in March 2026, so plan the move to Gateway API or another maintained controller. Existing installs keep working but no longer receive fixes.