Certificate Management
On this page 7 sections
Enable Automatic HTTPS certificate in an origin’s settings to have Spook Systems issue its certificate, renew it and deploy it to eligible QSCS nodes. QSCSCore serves that origin directly over HTTPS on port 443. You can also download the private key and full chain for your own load balancer or other infrastructure.
This is an optional setting for each origin hostname. For example, example.com and www.example.com are separate origins, each with its own certificate setting.
Before you enable HTTPS
- Add the origin to the appropriate QSCS domain. See Configuring Origins.
- Migrate the DNS zone containing that origin to Spook Systems and complete delegation verification. Importing a zone alone is not enough. The checkbox stays unavailable until migration is verified; follow DNS Delegation & Global Routing.
- Update directly exposed nodes to QSCSCore 4.2.14 or newer. See Upgrading.
- Allow inbound TCP port 443 and make sure another service is not already listening there. If Caddy, nginx or another HTTPS server owns that port, plan its handover before switching to native QSCS HTTPS. The checkbox does not stop that service for you.
- Put nodes that receive traffic through a load balancer in the correct Load-balancer group under Infrastructure. These nodes are skipped during native certificate deployment.
Public DNS must direct visitors to the intended node or load-balancer endpoint. Certificate management verifies control of the hostname; it does not publish a new routing policy. Review DNS routing separately when changing your public entry point.
Enable the certificate handler
- Open Control Panel → Infrastructure and manage the QSCS domain containing the origin.
- In its Origins list, choose Edit settings for the saved origin.
- Turn on Automatic HTTPS certificate. This switch applies immediately; it does not wait for the form’s Save settings button.
- Watch Generating and deploying certificate. The platform verifies DNS, issues the certificate and waits for eligible nodes to confirm HTTPS.
- When the panel shows HTTPS published, check the application using
https://and its origin hostname. The panel shows how many nodes confirmed HTTPS and how many were skipped because they belong to a load-balancer group.
Each direct node uses the certificate for the requested hostname. The existing HTTP listener remains available for internal delivery and load-balancer traffic, normally on port 8080. Use your network and firewall rules to control access to that listener; enabling HTTPS does not close it automatically.
For applications that upload data, native HTTPS accepts request bodies up to 16 MiB with a Content-Length header. Chunked request uploads are not supported. Streaming responses are supported.
DNS verification and automatic renewal
Spook Systems uses DNS-01 verification through its authoritative nameservers. It creates a temporary TXT value at _acme-challenge.<origin> and checks that both nameservers serve it before continuing. After validation, it removes only the challenge value it created, preserving unrelated TXT values and custom records. Cleanup also handles interrupted attempts.
Issuance is centralised: one certificate is issued for an origin per successful renewal cycle and distributed to its eligible nodes. A cluster with more than eight nodes does not request eight separate certificates. Repeated refreshes or saves reuse the existing issuance state rather than starting an order on every node.
Renewal is checked automatically before expiry. The platform rechecks DNS ownership and delegation, then distributes the renewed certificate without requiring another checkbox change. Failed issuance attempts retry with increasing delays rather than continuously requesting validation. A usable existing certificate remains available while renewal is retried; review a failure before it expires.
Read the status and resolve problems
| Status | Meaning and next step |
|---|---|
| Generating and deploying certificate | DNS verification, issuance or node deployment is in progress. After issuance, the confirmed-node count shows deployment progress. Use Refresh certificate status to check again. |
| HTTPS published | Eligible nodes have recently confirmed that the origin’s native HTTPS listener is serving on port 443. |
| Certificate ready for download | The certificate is issued and every node is covered by a load-balancer group. Install the certificate on your load balancer if it needs this certificate. |
| Certificate needs attention | Read the accompanying message. Check DNS delegation, CAA restrictions and conflicting _acme-challenge CNAME records for issuance failures. For deployment failures, check node versions, their control-plane connection and port 443. |
| Certificate status unavailable | The control panel could not confirm the current state. Refresh before changing the setting; unavailable status is not confirmation that an installed certificate has been removed. |
| Disabling HTTPS | The setting is off and the platform is waiting for nodes to acknowledge that native HTTPS has stopped. |
A port 443 is already in use message means another listener prevents QSCSCore from binding that port. Resolve the listener conflict on the affected node, or put the node in the appropriate load-balancer group if TLS should terminate there. Generating another certificate will not resolve a port conflict.
Certificate deployment status confirms the node’s listener. DNS routing and public reachability are checked separately in Control Panel → DNS; see DNS Zone Management.
Nodes behind a load balancer
Members of a defined load-balancer group do not receive the origin’s certificate for native port 443 serving. They keep their existing HTTP delivery, normally on port 8080, while the load balancer remains responsible for public TLS termination.
The certificate can still be generated and downloaded when all nodes are grouped. Downloading it does not install it on the load balancer, change its listeners or update its certificate store. Configure those separately. Adding a node to a group also removes it from the native certificate deployment targets when the updated policy reaches that node.
Download the private key and full chain
Once a valid certificate has been published, reopen the origin’s settings and use Download full chain or Download private key. Downloads require your authenticated account and are scoped to that account’s configured origin. They are not public download links.
- Full chain is a PEM file containing the origin certificate and its intermediate certificate chain.
- Private key is the matching PEM key. Keep it private and give it only to systems and administrators that must terminate HTTPS for this origin.
Download both files from the same certificate generation and follow the destination system’s import instructions. If a load balancer requires a different container format, prepare it using that system’s supported tooling.
Managed QSCS nodes receive renewals automatically. For a load balancer or offline system where you install files yourself, you must also install the renewed files before the previous certificate expires. Check the expiry shown in the origin settings.
Disable managed HTTPS
Turn off Automatic HTTPS certificate to remove this origin from native HTTPS deployment in the selected QSCS domain. Wait for the nodes to acknowledge the change. Other origins continue using their own settings, and the existing HTTP listener remains available.
Renewal stops when the hostname is no longer enabled in any QSCS domain in your account. Turning the switch off does not revoke an issued certificate or uninstall copies you imported into a load balancer or offline system. A still-valid issued certificate remains downloadable from the configured origin’s settings.
For related setup, see Configuring Origins and DNS Delegation & Global Routing.