Probably need a bit more detail for this like caddy logs and your caddy config. I did a similar thing on NixOS with services.acme getting the certs and then configuring the cert files to include caddy group access (I didn't use caddy directly either for those reading as the DNS challenge approach requires third party plugins which is a bit annoying on NixOS).