The easiest way would be to set up caddy to use acme on the servers, and never care about certificates again. See https://caddyserver.com/docs/automatic-https.
If you insist on your centralized solution, which is perfectly fine imo, just place the certificates to a directory properly accessible to caddy, and make sure to keep the permissions minimal, so that the keys are only accessible by authorized users.
If the certificates are only for caddy, there’s no reason to mess around in system folders.




It’s not about a different function providing different randomness, but providing a compatible implementation for environments not supporting the “regular” implementation.
If this screenshot is legit, I guarantee you that either the library is older and there was some weird branching for IE or it’s brand new and had branching for the hot new JS runtime / cross compiling.
Supporting a metric fuckton of browsers and environments takes the same amount of shims.