Certificates and ACME automation

Goal

Automate certificate issuance and renewal with ACME so hosts stay valid without manual work.

The certificate lifecycle

Every host needs a certificate; certificates expire; expired certificates cause outages that monitoring rarely catches until users complain. Automation is not optional at scale.

ACME in ShieldGate

ShieldGate speaks the ACME protocol (the same one Let's Encrypt uses):

1. You request a certificate for a host name.
2. The CA challenges you to prove control of the name (HTTP-01 challenge served by the proxy automatically).
3. The certificate is issued, stored, and bound to the host.
4. The worker renews it before expiry — no human involved.

Manual certificates

Some situations still need uploads: internal CA chains, wildcard certificates issued elsewhere, or names that cannot answer public challenges. Upload the PEM pair and bind it to the host; you own renewal reminders for these.

Steps

1. Open Certificates in the console.
2. Request an ACME certificate for your host name (the domain's DNS must already point at the proxy).
3. Watch the challenge complete and the certificate turn valid.
4. Confirm the host now serves the new certificate.

Verify

• The browser shows the issued certificate on your host.
• The certificate list shows the renewal date well before expiry.

Pitfalls

• HTTP-01 requires port 80 reachable from the internet — a firewall rule blocking it makes issuance fail with a challenge timeout.
• DNS must resolve to the proxy before you request; propagation delays cause confusing first-attempt failures.