SSL certificates

HTTPS for every VPS domain: the ArduMaker zone wildcard or a Let's Encrypt certificate issued when the domain is activated.

Category: Servers and infrastructure
Status: Available
Requirements: A domain that already reaches the VPS host (check it with verificar_dominio_vps); Being a member of the company with access to the VPS; For your own domain: port 80 of the domain must reach the host during validation
MCP tools (Read only): verificar_dominio_vps, ver_operacion
MCP tools (Write or modify): activar_dominio_vps

Markdown

What can you do with it?

Serve every published domain over HTTPS (TLS 1.2 and 1.3, HTTP/2), with an automatic HTTP to HTTPS redirect.
Use the ArduMaker zone wildcard certificate with no extra steps for single-level subdomains.
Issue a Let's Encrypt certificate for your own domain, or for a two-level subdomain of the zone, when activating the domain.
Publish a domain over plain HTTP when TLS is not wanted (use_ssl=false).

When should you use it?

When publishing any domain on a VPS: the certificate is handled in the same activation step.
When connecting a company's own domain to an app on the VPS.
When a domain shows a certificate error and it has to be requested again.

How does it work in ArduMaker?

TLS terminates on the shared host, never inside the VPS. Which certificate a domain uses depends on its name:

Domain	Certificate	What activation does
Single-level subdomain of the ArduMaker zone (`app.<zone>`)	Zone wildcard, issued and renewed by the platform	Issues nothing: `certificate.skipped: true`
Two-level subdomain of the zone (`api.app.<zone>`)	Let's Encrypt, specific to that name	Checks the DNS and issues with `create_cert=true`
Your own domain	Let's Encrypt, specific to that name	Checks the DNS and issues with `create_cert=true`

Issuing with Let's Encrypt

activar_dominio_vps validates the name and checks that the DNS reaches the host (A record to the host, CNAME to the VPS dnsip, or a proxy in front, which is accepted).
With create_cert=true (the default), the host requests the certificate from Let's Encrypt with certbot in standalone mode (HTTP validation on port 80). With email that address is registered; without it, it registers with no email.
Only once the certificate is issued is the host HTTPS server block that uses it written.
If validation fails, nothing is published and the answer carries only the authority's lines about THAT domain (Domain:, Type:, Detail:).

Activating a domain again with create_cert=true is safe: if the certificate is still valid, Let's Encrypt does not issue another one; if it expired, it is renewed. There is no separate tool for manual renewal.

What actually changes?

On the host: the domain certificate and key, and a server block with listen 443 ssl http2 that uses them, plus a block on port 80 that answers 301 to HTTPS.
On the VPS: nothing TLS-related.
On the Let's Encrypt side: one issuance per own domain (it counts towards its issuance limits).

Backups and databases

The weekly VPS backups include the certificates of your own domains (the live/, archive/ and renewal/ folders), so they can be restored. Platform certificates do not travel in the backup: the manifest lists them in ssl_domains_excluidos to tell “never had a certificate” from “had one and it does not travel”. See Backups.

TLS for databases with external access

When a database (PostgreSQL, MySQL or Redis) installed with Apps is opened to the outside, the engine gets its own certificate for its hostname, issued through DNS validation. It is renewed automatically when fewer than 30 days remain; if a renewal fails, the previous certificate stays loaded.

Diagram

Browser: HTTPS
Cloudflare: ArduMaker zone only: edge certificate
Host nginx :443: terminates TLS with the wildcard or Let's Encrypt
Port forward: internal traffic, no TLS
VPS nginx :443: plain HTTP

Where traffic is encrypted and where it is not

Expected result

certificate in the activar_dominio_vps answer: {success, domain, exit_code} if it was issued, or {success, skipped, reason, domain} if the wildcard was used.
With use_ssl=true the domain answers over HTTPS and port 80 redirects with a 301.
Check it with curl -sI https://<dominio>/ or by looking at the certificate in the browser.

Errors and troubleshooting

Error	Cause	What to do
`desafio_fallido`	Let's Encrypt could not validate the domain over HTTP (DNS not reaching the host, port 80 blocked by an external proxy or firewall)	Read `problems`, fix the DNS and activate again
`limite_emision`	A Let's Encrypt issuance limit was reached for that domain	Wait before retrying; repeating right away does not help
`certificado_del_host_ausente`	HTTPS was requested without a certificate issued for that name	Activate with `create_cert=true`, or with `use_ssl=false`
`Domain could not be resolved`	The domain does not resolve yet	Check the DNS and wait for propagation

The full certbot output is not returned (the host is shared): it stays in the server log. Activating a domain again is safe; be careful when repeating a failing issuance many times, because Let's Encrypt limits attempts.

MCP access

The certificate is requested with activar_dominio_vps (parameters use_ssl, create_cert and email). With your own domain it can be slow, because validation is real; the tool returns an operacion_id to follow with ver_operacion. Call the read-only verificar_dominio_vps first.

It is a write operation: an agent authorized as read-only cannot run it. There are no tools to read or export certificates or keys. Reference at /mcp/docs and examples at /mcp/dominios.