Caddy's default certificate issuance tries the HTTP-01 challenge, which requires inbound port 80, and the TLS-ALPN-01 challenge, which requires inbound port 443. Neither works when the server is behind NAT without port forwarding, on a network that blocks port 80, or issuing for an internal-only hostname.
The failure appears in the log as repeated challenge attempts with a connection or unauthorized error naming the domain, and the site serves nothing over HTTPS while the retries continue with backoff.
The DNS-01 challenge solves all three cases and is the only option for a wildcard certificate. It is not in the standard Caddy binary: a provider-specific DNS module must be compiled in with xcaddy or obtained from a custom build, then configured with tls { dns PROVIDER ... }. Attempting the dns directive on a stock binary fails at config load with an unrecognized module error, which is the clearest signal that a custom build is needed. The acme_dns global option applies the same provider to every site.