Skip to content
Dequel
Esc
↑↓navigate↵open⌘Jpreview
On this page

SSL Certificates

Automatic HTTPS via Let's Encrypt for every routed domain.

Dequel serves every routed hostname over HTTPS with certificates from Let’s Encrypt. There is nothing to buy, upload, or renew manually.

How provisioning works

  1. A project domain (default <slug>.<base-domain> or a verified custom domain) appears in a Caddy route file.
  2. On first request, Caddy completes an ACME HTTP-01 challenge and obtains a certificate.
  3. Caddy stores the certificate and renews it automatically before the 90-day expiry.

For this to work, the domain must resolve to the server and ports 80 and 443 must be reachable — the challenge runs over plain HTTP. If you terminate TLS in front of Dequel (for example Cloudflare proxy), use DNS-01 challenges or pause proxying until the first certificate is issued.

Local development

On localhost there is no public CA involved: Caddy serves plain HTTP for <slug>.localhost URLs, and the dashboard is available over both HTTP and HTTPS when a base domain is configured.

Troubleshooting

  • Domain shows TLS pending — confirm DNS resolves to the server IP and that no CDN is intercepting /.well-known/acme-challenge/.
  • Certificate errors on managed databases — database TLS uses the gateway’s own certificate, not Let’s Encrypt. See Managed Databases for the client flags.

Next steps