HTTPS Certificates Explained

HTTPS Certificates, Explained

You've seen the padlock icon in your browser's address bar. That padlock means the connection between you and the website is encrypted and verified — nobody in between can read or tamper with it. The thing that makes the padlock appear is called an HTTPS certificate (or just "certificate" or "cert").

Getting one used to mean paying a company, proving you own the domain, and manually renewing it every year before it expired (and everything breaking if you forgot). rust-proxy does all of that automatically, for free, using a nonprofit certificate authority called Let's Encrypt.

What you need to do: nothing, usually

If "Issue/renew a certificate automatically" is checked when you add a host (it is, by default — see Adding a Website), rust-proxy handles the entire certificate lifecycle by itself:

• Requests a new certificate the moment you add the host
• Renews it automatically well before it expires
• No emails to watch for, no manual steps, ever

The two ways it proves you own the domain

Let's Encrypt won't just hand out a certificate for app.example.com to anyone who asks — it needs proof you actually control that domain. rust-proxy has two ways of proving this, and picks automatically which one to use:

• A quick, temporary file check — Let's Encrypt briefly fetches a special file from your website to confirm you control it. Works well when the domain's regular web traffic (port 80) can reach this server directly.
• A DNS record check — rust-proxy briefly adds a special entry to your domain's DNS settings, and Let's Encrypt checks for it there instead. This is the only option for certificates that cover a whole family of subdomains at once (called a "wildcard" — e.g. one certificate for anything.example.com), and it works even when the domain's regular traffic can't reach this server directly.

The DNS check requires giving rust-proxy permission to make DNS changes for your domain — that's what the optional "DNS credential" step in the setup wizard (or the DNS credentials section of the admin panel) is for. If you never set one up, rust-proxy simply uses the file-check method instead, which needs no extra setup — it just needs port 80 open, which it is by default.

Certificates for a domain you already have one for

If you're moving a domain to this server and already have its certificate elsewhere, you can upload it directly instead of waiting for rust-proxy to issue a new one — see the Certificates tab in the admin panel. Just leave "Issue/renew a certificate automatically" unchecked for that host so rust-proxy doesn't try to replace what you uploaded.

Standalone certificates

Sometimes you want a certificate without creating a full website entry for it (for example, to use somewhere else entirely, outside rust-proxy). The Certificates tab's "Standalone DNS-01 certificates" section lets you request one on its own, using the DNS-check method described above.

In short

Turn the checkbox on (it already is), make sure your domain's DNS points at this server, and the padlock icon takes care of itself.