DefaultCertificateSelector should log a debug message if no matching certificates are found.

What would you like to have changed?

DefaultCertificateSelector in handshake.go should log a debug message if no matching certificates are found.

There is currently just a comment for that case, reading:

// all matching certs are expired or incompatible, oh well

Why is this feature a useful, necessary, and/or important addition to this project?

It's

1. Trivial to add.
2. Having it would ease debugging - I spent two hours wondering why things weren't working because I didn't bother adding SANs to my test certificates, and a debug message would have helped me find the problem sooner.

What alternatives are there, or what are you doing in the meantime to work around the lack of this feature?

I don't think there's any meaningful alternatives or workarounds.

Please link to any relevant issues, pull requests, or other discussions.

I have documented my mistakes so that others needn't repeat them. https://github.com/caddyserver/caddy/issues/5450

Start in handshake.go at DefaultCertificateSelector, especially the branch associated with the comment that all matching certificates are expired or incompatible. Add the requested debug logging there and verify that the message is emitted when no matching certificates are found.