HTTPS¶
Every Uberspace comes with its own enforced HTTPS certificate. Your
external domains as well as the .uber.space
default
domains, are automatically provided with a free certificate from
Let’s Encrypt. In combination with our default
security headers, this ensures that you and your
users always use a secure connection to prevent eavesdropping and injection of
unwanted content.
Let’s encrypt¶
We use lua-resty-auto-ssl to issue Let’s Encrypt certificates for every external domain that is connected to a Uberspace. This happens automagically when a domain (Host
header) is first seen by our webserver. For privacy reasons every domain gets its own certificate. We also handle the renewal, certificates will be renewed if they expire in less than 30 days.
Certificate Access¶
Once a certificate has been generated, you can find all relevant files in ~/etc/certificates
.
This includes your certificate chain - <domain>.crt
- as well as the private
key - <domain>.key
. If you do not make use of our webserver, you can copy
or directly use these files in your application. If you use PHP, static files or
web backends, we handle HTTPS for you and there is no need
to do anything.
Warning
Certificates issued by let’s encrypt have a short life of 90 days. We renew certificates when they are 60 days old. In practice, the provided files will change every 1-2 months.
Make sure to either restart your service once a month, or watch the files for changes and restart accordingly. Otherwise your service will use an outdated, invalid certificate.