Line a baking sheet with parchment paper or a silicone mat. Lightly grease the surface with cooking spray or neutral oil.
Combine the sugar, corn syrup, and water in a heavy-bottomed saucepan. Stir over medium heat until the sugar dissolves completely. Do not let the mixture boil before the sugar is dissolved.
Insert a candy thermometer into the pan, making sure the tip does not touch the bottom.
Increase the heat to medium-high and boil the mixture without stirring. Allow the syrup to reach 300 degrees Fahrenheit (149 degrees Celsius), which is the hard-crack stage. Watch carefully as it nears the temperature.
Once the mixture reaches 300 degrees F, immediately remove the pan from the heat. Carefully stir in the cinnamon oil, red food coloring, and citric acid (if using). Stir only until combined; over-stirring can cause crystallization.
Quickly pour the hot syrup onto the prepared baking sheet. Do not spread or touch the candy while it cools.
Allow the candy to cool completely and harden, which takes about 30 to 45 minutes.
Once fully hardened, place the candy sheet into a large, sturdy zip-top bag. Cover the bag with a clean kitchen towel. Use a meat mallet or the back of a heavy spoon to carefully break the candy into small, irregular ‘rock’ pieces.
Store the finished candy in an airtight container at room temperature.
Notes
Use a candy thermometer for accuracy; temperature control is the most important step for hard candy.
If the syrup starts to crystallize during cooking (forming grainy spots), add one tablespoon of water and gently stir until the crystals dissolve before continuing to heat.
Cinnamon oil provides a much stronger, more authentic flavor than extract, but use it sparingly as it is potent.
If you do not have cinnamon oil, use 1 tablespoon of high-quality cinnamon extract, but add it right before pouring to minimize flavor loss from the heat.