---
title: SSL Certificates
category: Security
description: Automatic HTTPS via Let's Encrypt for every routed domain.
slug: ssl
---

Dequel serves every routed hostname over HTTPS with certificates from
**Let's Encrypt**. There is nothing to buy, upload, or renew manually.

## How provisioning works

1. A project domain (default `<slug>.<base-domain>` or a verified
   [custom domain](/docs/domains)) appears in a Caddy route file.
2. On first request, Caddy completes an ACME HTTP-01 challenge and
   obtains a certificate.
3. Caddy stores the certificate and renews it automatically before the
   90-day expiry.

For this to work, the domain must resolve to the server and ports `80`
and `443` must be reachable — the challenge runs over plain HTTP. If
you terminate TLS in front of Dequel (for example Cloudflare proxy),
use DNS-01 challenges or pause proxying until the first certificate is
issued.

## Local development

On `localhost` there is no public CA involved: Caddy serves plain HTTP
for `<slug>.localhost` URLs, and the dashboard is available over both
HTTP and HTTPS when a base domain is configured.

## Troubleshooting

- **Domain shows TLS pending** — confirm DNS resolves to the server IP
  and that no CDN is intercepting `/.well-known/acme-challenge/`.
- **Certificate errors on managed databases** — database TLS uses the
  gateway's own certificate, not Let's Encrypt. See
  [Managed Databases](/docs/databases) for the client flags.

## Next steps

- Read [Custom Domains](/docs/domains) to add domains.
- Read [Managed Databases](/docs/databases) for database TLS behavior.