TLS certificates

TLS terminates at the load balancer. The panel obtains the certificate, stores it, and delivers it with the load balancer’s configuration. There is nothing to install and nothing to renew by hand.

What runs underneath

Layer	Technology
Protocol	ACME, against Let’s Encrypt
Challenge	DNS-01 — a TXT record written into the DNS zone the platform hosts for your domain
Client	Runs inside the API process as a scheduled scan. There is no separate certificate daemon
Storage	The control plane database; the certificate belongs to your organisation
Delivery	Included in the load balancer’s configuration pull, written to disk with restrictive permissions, and loaded by HAProxy on reload

Why the certificate lives in the panel

The alternative — each appliance obtaining its own certificate — was rejected for reasons that show up quickly in production:

• A rebuilt appliance would request a new certificate every time, and Let’s Encrypt limits how many identical certificates you may obtain per week. The first bad day would exhaust that limit.
• With more than one appliance, each would need its own certificate, and an HTTP-based challenge would land on whichever one the load balancer happened to pick.
• Wildcards are not obtainable at all with an HTTP challenge.
• A load balancer with no public address could never be validated.

Keeping the certificate in the panel makes the appliance stateless: rebuild it and it downloads the same certificate.

Why DNS-01, and how it coexists with Cloudflare’s proxy

The DNS challenge solves three problems at once:

1. It works with no inbound reachability, so internal load balancers get real certificates.
2. It is the only way to obtain wildcards.
3. It leaves port 80 alone — an HTTP challenge would need a listener on 80 that competes with yours.

There is a fourth benefit that matters if you use Cloudflare. TXT records are never proxied, so certificate issuance and renewal keep working whether or not you have turned Cloudflare’s proxy on for that name. The panel never writes the proxy flag: when it updates a record it reads the existing proxy setting and writes it back unchanged. Hiding your origin address behind Cloudflare and terminating TLS on your load balancer are independent choices, and you can have both. See Using zone9 with Cloudflare.

Getting a certificate

You normally do not ask for one directly. Setting a hostname on a listener and choosing TLS burada sonlansın (Terminate TLS here) creates the certificate record for you and the scan picks it up.

Preconditions

Requirement	Why
The domain is in your account	Certificates are scoped to an organisation
Its DNS is hosted by the platform	The challenge record must be written into a zone we control

If the DNS is elsewhere, the panel says so and offers the fix — move DNS to the platform under Domains and DNS — rather than failing at issuance time and consuming an attempt.

Status and renewal

A certificate is pending, issuing, ready or error, and the listener row shows it in words: obtaining, valid until a date, or the failure reason.

Renewal starts 30 days before expiry. The scan wakes on a timer, so nothing is scheduled at the last minute; a week-long DNS outage does not cost you the certificate.

Failures back off exponentially — roughly a minute, then five, then twenty-five, up to a day. This is not politeness: repeating a failing order in a loop consumes your domain’s weekly rate limit and turns a small misconfiguration into a lockout. If you have fixed the underlying problem and do not want to wait, there is an explicit retry that clears the backoff.

Issuance takes minutes rather than seconds: the record has to be published and observed by public resolvers before Let’s Encrypt is asked to look. Telling it to look too early invalidates the order.

Multiple names

Each hostname on a listener gets its own certificate record. Certificates are matched to incoming connections by SNI, from the names inside the certificates themselves — so adding a name is adding a listener, with nothing to reconfigure.

Reusing a hostname on a second listener reuses the existing certificate rather than requesting a duplicate.

Rate limits worth knowing

Let’s Encrypt’s production limits apply, and the panel is deliberate about not burning them: roughly 50 certificates per registered domain per week, and 5 identical certificates per week. The backoff and the “reuse an existing certificate” rule exist to keep you inside them.

Limits

• Let’s Encrypt only; uploading your own certificate is not supported yet.
• DNS-01 only, so the domain’s DNS must be hosted by the platform. HTTP-01 for externally-hosted domains is planned.
• No revocation from the panel; deleting a certificate removes it from the platform but does not revoke it.
• Private keys are stored in the control plane database without application-level encryption today. This is a known gap, tracked with the other secret-storage debt in Known gaps.
• TLS to the backend is not re-established; traffic from the load balancer to your targets is plain inside your private network.