# SSL certificates

HTTPS for every VPS domain: the ArduMaker zone wildcard or a Let's Encrypt certificate issued when the domain is activated.

Source: https://ardumaker.com/en/docs/ssl/

- Category: Servers and infrastructure
- Status: Available
- Requirements: A domain that already reaches the VPS host (check it with `verificar_dominio_vps`); Being a member of the company with access to the VPS; For your own domain: port 80 of the domain must reach the host during validation
- MCP tools (Read only): `verificar_dominio_vps`, `ver_operacion`
- MCP tools (Write or modify): `activar_dominio_vps`

## What can you do with it?

- Serve every published domain over HTTPS (TLS 1.2 and 1.3, HTTP/2), with an automatic HTTP to HTTPS redirect.
- Use the ArduMaker zone wildcard certificate with no extra steps for single-level subdomains.
- Issue a Let's Encrypt certificate for your own domain, or for a two-level subdomain of the zone, when activating the domain.
- Publish a domain over plain HTTP when TLS is not wanted (`use_ssl=false`).

## When should you use it?

- When publishing any domain on a VPS: the certificate is handled in the same activation step.
- When connecting a company's own domain to an app on the VPS.
- When a domain shows a certificate error and it has to be requested again.

## How does it work in ArduMaker?

TLS **terminates on the shared host**, never inside the VPS. Which certificate a domain uses depends on its name:

| Domain | Certificate | What activation does |
| --- | --- | --- |
| Single-level subdomain of the ArduMaker zone (`app.<zone>`) | Zone wildcard, issued and renewed by the platform | Issues nothing: `certificate.skipped: true` |
| Two-level subdomain of the zone (`api.app.<zone>`) | Let's Encrypt, specific to that name | Checks the DNS and issues with `create_cert=true` |
| Your own domain | Let's Encrypt, specific to that name | Checks the DNS and issues with `create_cert=true` |

### Issuing with Let's Encrypt

1. `activar_dominio_vps` validates the name and checks that the DNS reaches the host (A record to the host, CNAME to the VPS `dnsip`, or a proxy in front, which is accepted).
2. With `create_cert=true` (the default), the host requests the certificate from Let's Encrypt with `certbot` in standalone mode (HTTP validation on port 80). With `email` that address is registered; without it, it registers with no email.
3. Only once the certificate is issued is the host HTTPS server block that uses it written.
4. If validation fails, nothing is published and the answer carries only the authority's lines about THAT domain (`Domain:`, `Type:`, `Detail:`).

> **INFO:** Private keys stay on the host: they are never copied to the VPS nor returned in a response. The VPS nginx listens on plain HTTP and needs no certificates.

Activating a domain again with `create_cert=true` is safe: if the certificate is still valid, Let's Encrypt does not issue another one; if it expired, it is renewed. There is no separate tool for manual renewal.

## What actually changes?

- On the host: the domain certificate and key, and a server block with `listen 443 ssl http2` that uses them, plus a block on port 80 that answers 301 to HTTPS.
- On the VPS: nothing TLS-related.
- On the Let's Encrypt side: one issuance per own domain (it counts towards its issuance limits).

## Backups and databases

The weekly VPS backups include the certificates of your own domains (the `live/`, `archive/` and `renewal/` folders), so they can be restored. Platform certificates do **not** travel in the backup: the manifest lists them in `ssl_domains_excluidos` to tell “never had a certificate” from “had one and it does not travel”. See [Backups](https://ardumaker.com/en/docs/backups).

### TLS for databases with external access

When a database (PostgreSQL, MySQL or Redis) installed with Apps is opened to the outside, the engine gets its own certificate for its hostname, issued through DNS validation. It is renewed automatically when fewer than 30 days remain; if a renewal fails, the previous certificate stays loaded.

## Diagram

**Where traffic is encrypted and where it is not**

```text
Browser (HTTPS)
  ↓
Cloudflare (ArduMaker zone only: edge certificate)
  ↓
Host nginx :443 (terminates TLS with the wildcard or Let's Encrypt)
  ↓
Port forward (internal traffic, no TLS)
  ↓
VPS nginx :443 (plain HTTP)
```

## Expected result

- `certificate` in the `activar_dominio_vps` answer: `{success, domain, exit_code}` if it was issued, or `{success, skipped, reason, domain}` if the wildcard was used.
- With `use_ssl=true` the domain answers over HTTPS and port 80 redirects with a 301.
- Check it with `curl -sI https://<dominio>/` or by looking at the certificate in the browser.

## Errors and troubleshooting

| Error | Cause | What to do |
| --- | --- | --- |
| `desafio_fallido` | Let's Encrypt could not validate the domain over HTTP (DNS not reaching the host, port 80 blocked by an external proxy or firewall) | Read `problems`, fix the DNS and activate again |
| `limite_emision` | A Let's Encrypt issuance limit was reached for that domain | Wait before retrying; repeating right away does not help |
| `certificado_del_host_ausente` | HTTPS was requested without a certificate issued for that name | Activate with `create_cert=true`, or with `use_ssl=false` |
| `Domain could not be resolved` | The domain does not resolve yet | Check the DNS and wait for propagation |

The full `certbot` output is not returned (the host is shared): it stays in the server log. Activating a domain again is safe; be careful when repeating a failing issuance many times, because Let's Encrypt limits attempts.

## MCP access

The certificate is requested with `activar_dominio_vps` (parameters `use_ssl`, `create_cert` and `email`). With your own domain it can be slow, because validation is real; the tool returns an `operacion_id` to follow with `ver_operacion`. Call the read-only `verificar_dominio_vps` first.

It is a write operation: an agent authorized as read-only cannot run it. There are no tools to read or export certificates or keys. Reference at [/mcp/docs](https://ardumaker.com/en/mcp/docs) and examples at [/mcp/dominios](https://ardumaker.com/en/mcp/dominios).

## Related features

- [Nginx](https://ardumaker.com/en/docs/nginx/)
- [Domains and DNS](https://ardumaker.com/en/docs/dominios-y-dns/)
- [Backups](https://ardumaker.com/en/docs/backups/)
- [VPS servers](https://ardumaker.com/en/docs/vps/)