HTTPS Certificates, Explained

Updated Oct 27, 2026

You've seen the padlock icon in your browser's address bar. That padlock means the connection between you and the website is encrypted and verified — nobody in between can read or tamper with it. The thing that makes the padlock appear is called an HTTPS certificate (or just "certificate" or "cert").

Getting one used to mean paying a company, proving you own the domain, and manually renewing it every year before it expired (and everything breaking if you forgot). RustProxy does all of that automatically, for free, using a nonprofit certificate authority called Let's Encrypt.

What you need to do: nothing, usually

RustProxy calls this Auto-SSL. If Auto-SSL (ACME) is checked when you add a site (it is, by default; see Adding a Website), RustProxy handles the entire certificate lifecycle by itself:

• Requests a new certificate the moment you add the host
• Renews it automatically well before it expires
• No emails to watch for, no manual steps, ever

The two ways it proves you own the domain

Let's Encrypt won't just hand out a certificate for app.example.com to anyone who asks — it needs proof you actually control that domain. RustProxy has two ways of proving this, and picks automatically which one to use:

• A quick, temporary file check — Let's Encrypt briefly fetches a special file from your website to confirm you control it. Works well when the domain's regular web traffic (port 80) can reach this server directly.
• A DNS record check — RustProxy briefly adds a special entry to your domain's DNS settings, and Let's Encrypt checks for it there instead. This is the only option for certificates that cover a whole family of subdomains at once (called a "wildcard" — e.g. one certificate for anything.example.com), and it works even when the domain's regular traffic can't reach this server directly.

On the site form this choice is How to prove you own the domain: Automatic (the DNS check, falling back to the file check), Web check or DNS check.

The DNS check requires giving RustProxy permission to make DNS changes for your domain — that's what the optional "DNS credential" step in the setup wizard (or the DNS credentials section of the admin panel) is for. If you never set one up, RustProxy simply uses the file-check method instead, which needs no extra setup — it just needs port 80 open, which it is by default.

The Certificates page

Go to Sites, then Certificates, to see every certificate, soonest to expire first. The Managed by column says whether Auto-SSL looks after it or you uploaded it.

Renew now (on Auto-SSL certificates) gets a fresh certificate straight away instead of waiting for the automatic renewal. It usually takes under a minute. Let's Encrypt allows only about five renewals of the same certificate a week, so keep it for when you need it, for example after fixing a DNS problem.

If Auto-SSL can't get a certificate, the message tells you what to check first: the DNS credential for the DNS check, or that the domain points at this server and port 80 is reachable for the web check.

Certificates for a domain you already have one for

If you're moving a domain to this server and already have its certificate, you can upload it under Sites, then Certificates, instead of waiting for RustProxy to issue a new one. Turn off Auto-SSL (ACME) on that site so RustProxy doesn't replace what you uploaded.

Standalone certificates

Sometimes you want a certificate without creating a full website entry for it (for example, to use somewhere else entirely, outside RustProxy). The Certificates page's "Standalone DNS-01 certificates" section lets you request one on its own, using the DNS-check method described above.

In short

Turn the checkbox on (it already is), make sure your domain's DNS points at this server, and the padlock icon takes care of itself.