also, you must make sure port 80 is open as well on the VM for caddy to request certs. I dont think we document that right now.