On-demand TLS makes Caddy obtain a certificate during the TLS handshake for whatever server name the client presents. It is the mechanism behind multi-tenant custom domains. Without a guard, any client that connects with an arbitrary SNI value causes a certificate request, which is trivially abused into exhausting rate limits or into using the server as an issuance proxy.
Caddy therefore requires the ask option in the global on_demand_tls block for public use. ask names an endpoint Caddy calls with the domain as a query parameter; a 200 response authorizes issuance and anything else declines. The endpoint must be fast, because it runs inside the handshake path.
Configure the guard globally and then enable the feature per site with tls { on_demand }. Caddy also supports rate limiting on-demand issuance through the same global block. Note that on-demand certificates are still stored and reused, so the ask endpoint is consulted on first issuance and on renewal rather than on every connection. A misconfigured ask endpoint that returns an error causes handshake failures that appear to clients as a generic TLS error with no useful detail.