Domains & SSL

The Domains & SSL tab lets you view SSL certificate status for each domain attached to your app and provision new certificates. Open your app's detail page and click the Domains & SSL tab.

Viewing certificate status

Each domain is listed with its current SSL state:

• Green lock icon — An active SSL certificate is installed. The certificate type (Let's Encrypt or Custom), issuer, expiry date, and auto-renew status are shown.
• Gray lock icon — No SSL certificate. The domain is served over plain HTTP.

Provisioning a Let's Encrypt certificate

Let's Encrypt certificates are free, automatically renewed, and the recommended option for most apps.

Prerequisites

• The domain's DNS A record must point to your server's IP address before provisioning. Let's Encrypt validates domain ownership via an HTTP challenge, so the domain must resolve to the server.

Steps

1. Select the domain from the dropdown.
2. Choose Let's Encrypt (Free, Auto-renew) as the certificate type.
3. Enter an email address. This is used for Let's Encrypt account registration and expiry notifications. It defaults to your account email.
4. Click Provision Let's Encrypt SSL.

Provisioning typically takes 15-30 seconds. Once complete, the domain's status updates to show the green lock icon with certificate details.

What happens automatically

• Your SSL certificate is obtained and installed on the server.
• HTTP-to-HTTPS redirect is configured automatically.
• Security headers (HSTS) are enabled.
• HTTP/2 is enabled for better performance.
• Automatic certificate renewal is set up.

Uploading a custom certificate

Use this option if you have a certificate from another CA (e.g., a wildcard or EV certificate).

Steps

1. Select the domain from the dropdown.
2. Choose Custom Certificate.
3. Upload the following files (PEM format):
   • Certificate File (.pem, .crt, or .cer) — Required.
   • Private Key File (.pem or .key) — Required.
   • CA Chain File (.pem, .crt, or .cer) — Optional but recommended for full chain validation.
4. Click Deploy Custom Certificate.

The certificate and key are deployed to the server and your app is configured to use them. HTTP-to-HTTPS redirect and security headers are enabled automatically, just like with Let's Encrypt.

Removing SSL

To remove an SSL certificate from a domain:

1. Find the domain in the certificates list.
2. Click the Remove button next to it.
3. Confirm the action in the dialog.

The site will revert to serving over HTTP only.

Troubleshooting

If SSL provisioning fails, an error banner appears at the top of the tab. Click the arrow to expand the full error log. Common issues:

• DNS not pointing to server — The domain's A record must resolve to the server's IP. Use dig or an online DNS checker to verify.
• Port 80 blocked — Let's Encrypt needs to reach port 80 on your server for the HTTP-01 challenge. Ensure your firewall allows inbound traffic on port 80.
• Rate limits — Let's Encrypt has rate limits (50 certificates per registered domain per week). If you hit a limit, wait and retry later.

You can copy the error log to your clipboard using the copy button in the error banner for easier debugging or when contacting support.