From a2afbdfd13bdd20cf1136edf5ff5ef246ddd235e Mon Sep 17 00:00:00 2001
From: Knud Hollander <26556793+KnudH@users.noreply.github.com>
Date: Thu, 13 Aug 2026 10:43:53 +0200
Subject: [PATCH] Update documentation for CA private key optional

Clarify that the private key field is optional and can be omitted if a signed intermediate certificate is provided.
---
 src/docs/markdown/caddyfile/options.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/docs/markdown/caddyfile/options.md b/src/docs/markdown/caddyfile/options.md
index e8f9e9d7..32b69e6f 100644
--- a/src/docs/markdown/caddyfile/options.md
+++ b/src/docs/markdown/caddyfile/options.md
@@ -1401,7 +1401,7 @@ A key pair (certificate and private key) to use as the root for the CA. If not s
 
 - **format** is the format in which the certificate and private key are provided. Currently, only `pem_file` is supported, which is the default, so this field is optional.
 - **cert** is the certificate. This should be the path to a PEM file, when using `pem_file` format.
-- **key** is the private key. This should be the path to a PEM file, when using `pem_file` format.
+- **key** is the private key. This should be the path to a PEM file, when using `pem_file` format. If you’re providing a signed intermediate certificate and don’t want to—or can’t—provide the key, for example because it’s stored on a hardware key, you can omit it. This field is therefore optional.
 
 ##### `intermediate`
 A key pair (certificate and private key) to use as the intermediate for the CA. If not specified, one will be generated and managed automatically.