diff --git a/modules/caddytls/tls.go b/modules/caddytls/tls.go
index c111bbba2..a93183e6f 100644
--- a/modules/caddytls/tls.go
+++ b/modules/caddytls/tls.go
@@ -87,6 +87,7 @@ func (TLS) CaddyModule() caddy.ModuleInfo {
 func (t *TLS) Provision(ctx caddy.Context) error {
 	t.ctx = ctx
 	t.logger = ctx.Logger(t)
+	repl := caddy.NewReplacer()
 
 	// set up a new certificate cache; this (re)loads all certificates
 	cacheOpts := certmagic.CacheOptions{
@@ -176,6 +177,11 @@ func (t *TLS) Provision(ctx caddy.Context) error {
 		onDemandRateLimiter.SetWindow(0)
 	}
 
+	// run replacer on ask URL (for environment variables)
+	if t.Automation != nil && t.Automation.OnDemand != nil && t.Automation.OnDemand.Ask != "" {
+		t.Automation.OnDemand.Ask = repl.ReplaceAll(t.Automation.OnDemand.Ask, "")
+	}
+
 	// load manual/static (unmanaged) certificates - we do this in
 	// provision so that other apps (such as http) can know which
 	// certificates have been manually loaded, and also so that