TLS and certificates

Control separates certificate resources from Site identity. Normal Site HTTPS is managed from the Site workspace, while Sites → Certificates provides a host-level inventory for reusable certificates.

Site HTTPS

Enable HTTPS after the Site and DNS are ready. Control verifies that the requested hostname belongs to the intended Site before treating TLS as valid.

Shared certificates

A reusable certificate can be attached to multiple compatible Sites when its covered names include every attached hostname that needs HTTPS. Manage attachments without reissuing the certificate when the coverage is already suitable.

Let's Encrypt wildcard certificates

Wildcard issuance uses DNS-01. With a configured Cloudflare DNS provider, Control can create and remove the challenge record automatically. A wildcard such as *.example.com does not cover the apex example.com, so include the apex when required.

Manual DNS challenge

For other DNS providers, Control can show the required TXT challenge and wait while you publish it. Manual DNS certificates also require operator participation when renewal needs another challenge.

Import an external certificate

Import a certificate/full chain and matching private key. Control validates the key pair, current validity and covered names before creating the reusable certificate resource.

Micro CMS exact-name TLS

External Micro CMS Silo domains on dedicated catch-all ingress use exact-name certificates after public DNS points to the configured ingress address. Their TLS lifecycle follows the current Micro CMS domain registration rather than being manually reassigned to unrelated Sites.

Apex and www

For an apex Site, the conventional www. companion can be attached to the same Site and included in certificate coverage after DNS readiness is proven. Use Preferred Hostname to choose redirect direction once both hostnames are owned and secured.