ShieldGate Docs

Certificates

Certificates overview

PEM upload, ACME HTTP-01, SNI, and Worker renewal jobs.

Goal

Terminate TLS on the data plane with certificates managed from the control plane.

Prerequisites

  • Worker running for ACME and renewal.
  • Hosts created for names you will request.
  • Permission certificates.read / certificates.write.

Options

Approach When to use
PEM upload You already have cert + key
ACME HTTP-01 Automate Let’s Encrypt (staging or prod directory)

Wildcards and DNS-01 are not supported in the current ACME MVP. Mutual TLS client enforcement is deferred.

High-level flow

  1. Upload PEM or create an ACME order for hostnames.
  2. Bind certificate to proxy host (primary SNI).
  3. Snapshot includes material for the Proxy.
  4. Enable DataPlane:Https on the Proxy when ready.
  5. Worker renews AutoRenew certs before expiry.

Next