Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settings
Security
Security overview and big screenAttack logCC protectionWAFLists and access controlBots and scannersPaid protection add-ons
Analytics and alerts
StatisticsAccess logsAlerts and notifications
Accounts and licensing
Users and plansLicenses and add-ons

HTTPS certificates

About 5 minUpdated 2026-10-28

Where certificates come from

  • Free certificate: click "Request certificate" in the site's HTTPS settings. The platform requests it from Let's Encrypt or ZeroSSL, usually within 10 minutes, and renews it automatically before expiry. The default issuer is set by the administrator; tenants can also bind their own account under Certificate Management › ZeroSSL Account.
  • Upload a certificate: if you have your own, click "Upload certificate" and paste the certificate and private key.
  • Wildcard certificate: request it after configuring a DNS account under Certificate Management › DNS API; one-click request does not support wildcards.
  • IP certificate: requested and renewed automatically for IP sites, and trusted directly by visitors' browsers.

Certificates are managed in Site Management › Certificate Management › Domain Certificates (All Certificates for administrators), where expiry dates are shown.

Tip Before requesting a free certificate the domain must already resolve to the nodes, otherwise validation fails. Finish Set up the CNAME record first.

Turn on HTTPS

In the site's HTTPS settings, switch on the main HTTPS switch and choose a certificate. After saving, nodes start listening on 443.

Common options

  • Force HTTPS: HTTP visitors get a 301 redirect to HTTPS; you can set the redirect port (443 by default).
  • HTTP/2: several requests share one connection, which speeds up first paint on pages with many small files.
  • HTTP/3: based on QUIC; the visitor's network must allow UDP 443.
  • HSTS: adds a Strict-Transport-Security header (one year); browsers then upgrade HTTP to HTTPS by themselves for a year.
Caution HSTS cannot be revoked from the server side once enabled. Turn it on only after the whole site and all subdomains support HTTPS.