ShieldGate Docs

Certificates

SNI bindings

Attach certificates to hosts for hostname-based TLS selection.

Goal

Bind a certificate as the primary SNI cert for a host.

Steps

  1. Open the certificate detail → Bindings.
  2. Select the proxy host / hostname.
  3. Mark primary SNI as required by the UI.
  4. Save (auto-publish typical).
  5. Enable HTTPS on the Proxy (DataPlane:Https:Enabled=true, listen port).

Runtime

Proxy CertificateRuntimeStore maps hostname → certificate (exact and imported wildcard material when present). Kestrel uses ServerCertificateSelector for SNI.

Verify

openssl s_client -connect <proxy-host>:<https-port> -servername <hostname>

Confirm the expected certificate subject/SAN.