Academy
Practical explainers on ACME, DNS-01, HTTP-01, wildcards, SaaS custom domains, and renewals.
What is ACME?
ACME is the protocol Let’s Encrypt uses to issue DV certificates without a human in the loop.
DNS-01 explained
A TXT record at _acme-challenge proves you control the DNS zone. That is how wildcards get issued.
HTTP-01 explained
Serving a file on port 80 is the oldest ACME challenge. It is simple when you already terminate HTTP on the name.
Wildcard certificates in practice
When a wildcard helps, when it hides risk, and why DNS-01 is mandatory.
SaaS custom domains and TLS
How multi-tenant products issue certificates for customer DNS names.
Why 90-day certificates need automation
Let’s Encrypt lifetimes make calendar reminders a poor control. Renew in software.
Private keys vs customer CSR
Choose platform-generated keys when you want the API to hold the secret, or CSR mode when the key never leaves your HSM.
SAN certificates
Subject Alternative Names let one certificate cover several hostnames. Keep the SAN list intentional.
Certificate Transparency
CT logs publish issued certificates so unexpected names can be detected. Monitoring is not the same as compromise.
mTLS and client certificates
Mutual TLS authenticates the client with a certificate. Short-lived client certs reduce stolen-credential windows.
DV, OV and EV
Validation level describes identity checks, not encryption strength. Browsers no longer show EV as a green address bar.
Multi-CA routing
A router picks a CA from product, plan, health and capability. After challenges are presented, failover needs a new order.
Automating TLS on Plesk
Connect a subscription, discover bindings, deploy a replacement certificate, reload the vhost, keep a rollback copy.
Automating TLS on cPanel
WHM/cPanel APIs can install certificates on a domain. Scope the token to the account you manage.
Safe Nginx certificate reloads
Write cert/key atomically, validate nginx -t, then reload. Never expose a shell from user input.
Safe Apache certificate reloads
Same atomic write + configtest + graceful restart pattern as Nginx.
Certificates in Kubernetes
Secrets, ingress annotations and cert-manager are different models. This platform can supply PEM for a controller to consume.
DNS-01 on Route 53
A scoped IAM user that can change only the challenge record is enough. Cleanup must delete only records the platform created.
DNS-01 on Azure DNS
Use a service principal limited to the DNS zone. Test connection before first issuance.
DNS-01 on Cloud DNS
A service account with dns.resourceRecordSets.update on one project is the least privilege target.
DNS-01 on Hetzner
Hetzner DNS API tokens create TXT records for ACME. Delete them after validation.
DNS-01 on DigitalOcean
A write-scoped token on the domain is sufficient for TXT automation.
Monitoring unmanaged certificates
Import a hostname or PEM and watch expiry without taking the private key.
SaaS custom hostname lifecycle
pending → ownership_validation → certificate_pending → active → renewing. Failed states keep instructions.
Swedish VAT on SaaS invoices
Domestic B2B typically 25%. EU B2B with a valid VAT ID is reverse charge. Do not hard-code 25% for every customer.