Certs

Introduction

A cert is a TLS certificate issued through ACME — by default via Let’s Encrypt, with ZeroSSL available as an alternative provider. Certs live at the project level, alongside your serverlets, proxies, and DNS zones.

You don’t usually need to think about certs at all: every HTTP proxy gets one automatically the moment it’s created, covering its source domain with no configuration required. The Certs page exists for the cases where you want visibility or control beyond that — checking a certificate’s expiry and issuance state, covering a domain with extra alternative names, forcing a renewal, or requesting a certificate ahead of attaching it anywhere.

Automatic certs for proxies

When you create an HTTP proxy, Futrou provisions a matching cert behind the scenes:

• If a DNS zone already exists in the project for the proxy domain’s parent (for example a zone for example.com and a proxy on api.example.com), Futrou requests a wildcard certificate for *.example.com with the apex domain (example.com) as an additional name — one certificate then covers the apex and every subdomain in that project.
• Otherwise, Futrou requests a certificate for the proxy’s exact domain only.
• If an existing cert in the project already covers the domain (an exact match, or a wildcard whose base domain matches), nothing new is created.
• Auto-provisioning is skipped for generated *.futrou.cloud addresses — Futrou’s own wildcard covers those, and Nasua doesn’t issue certs for them.

This is why you’ll typically see certs appear in the project without having created them by hand. Deleting the proxy doesn’t delete the cert automatically — manage it from the Certs page if you no longer need it.

Requesting a certificate

• Region — where the certificate is issued and validated, or Auto to let Futrou choose.
• Domain — the primary domain the certificate covers. Use *.example.com to request a wildcard.
• Alt Names (SANs) — additional domains covered by the same certificate, comma-separated. Optional.
• Provider — Let's Encrypt (default) or ZeroSSL.
• Key Type — ECDSA (default) or RSA.

Domain, provider, and key type can’t be changed after creation — request a new certificate instead if you need different coverage.

Validation

Domain ownership is validated the same way as elsewhere on the platform: a wildcard domain is validated over DNS (a TXT record challenge), a non-wildcard domain over HTTP. If the project’s DNS zone for the domain is already hosted on Futrou, DNS validation typically completes without any action on your part; otherwise you may need matching DNS records in place before issuance succeeds.

Status and lifecycle

A certificate’s page shows live data fetched from Nasua at the time you open it, alongside the record stored in Futrou Cloud:

A certificate that’s still pending shortly after creation is normal — issuance and validation happen asynchronously against the ACME provider and aren’t instant.

Renewing

Futrou renews certificates automatically before they expire. Use Renew on a certificate’s page to force an immediate renewal instead of waiting — useful after fixing a validation problem, or if you want a fresh certificate right away rather than on the automatic schedule.

Troubleshooting a failed issuance

If a certificate’s state is failed, check the Error message on its page first — it comes directly from the ACME issuance attempt. Common causes:

• DNS validation didn’t complete. For a wildcard or DNS-validated domain, the required TXT record wasn’t found in time. Confirm the domain’s DNS zone is on Futrou (or that the challenge record was published at your external DNS provider) and retry with Renew.
• HTTP validation didn’t complete. For a non-wildcard domain, the ACME provider couldn’t reach an HTTP validation endpoint on the domain — typically because the domain doesn’t point at Futrou yet, or a proxy for it doesn’t exist.
• Rate limits at the ACME provider. Let’s Encrypt and ZeroSSL both cap how many certificates can be issued for the same domain in a period; retrying immediately after a rate-limit failure won’t help, wait and retry later, or switch provider.

Deleting

Deleting a certificate removes it from Futrou Cloud and revokes it in Nasua. This doesn’t affect the proxy or DNS zone it was covering — if a proxy still needs a certificate, a new one will be provisioned for it as needed.

Region

Like other services, a cert runs in a specific region, or you can leave it on Auto. A cert should generally sit in the same region as the proxy or DNS zone it’s paired with.