SSL/TLS Certificates

Overview

Dokploy provides automatic SSL/TLS certificate management through Traefik integration. You can use free Let’s Encrypt certificates or bring your own custom certificates for secure HTTPS connections.

Automatic SSL

Free Let’s Encrypt certificates with auto-renewal

Custom Certificates

Use your own SSL certificates

Wildcard Support

Secure multiple subdomains with one certificate

SSL Certificate Types

Dokploy supports three certificate types:

Let's Encrypt (Recommended)
Custom Certificate
None (Development)

Automatic, free SSL certificates:

Automatic certificate issuance
Auto-renewal before expiration
Supports HTTP-01 and DNS-01 challenges
Trusted by all major browsers
Rate limit: 50 certificates per week per domain

Best for: Production websites and APIs

Let’s Encrypt Configuration

Automatic HTTPS (HTTP-01 Challenge)

The default method works for most use cases:

Configure Domain

When adding a domain to your application:

Enter your domain name (e.g., example.com)
Select Let’s Encrypt as certificate type
Ensure your domain’s DNS points to your server

Deploy

Dokploy automatically:

Requests certificate from Let’s Encrypt
Completes HTTP-01 challenge
Configures Traefik with the certificate
Redirects HTTP to HTTPS

Auto-Renewal

Certificates are automatically renewed 30 days before expiration.

DNS-01 Challenge (Wildcard Certificates)

For wildcard certificates (e.g., *.example.com):

traefik-config.yml

certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /letsencrypt/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "8.8.8.8:53"

DNS-01 requires API credentials for your DNS provider (Cloudflare, Route53, etc.).

Supported DNS Providers

Traefik supports 100+ DNS providers:

Cloudflare
AWS Route53
Google Cloud DNS
DigitalOcean
Namecheap
GoDaddy
And many more

See Traefik DNS providers for the full list.

Custom Certificates

Upload Certificate

Prepare Certificate Files

You need:

Certificate file (.crt or .pem)
Private key file (.key)
Optional: CA bundle/chain file

Add Certificate in Dokploy

Navigate to Settings → Certificates → Add Certificate

name

string

required

A friendly name for the certificate

certificateData

string

required

The certificate content (PEM format)

privateKey

string

required

The private key content (PEM format)

certificateChain

string

Optional CA bundle/intermediate certificates

Assign to Domain

When configuring a domain:

Select Custom as certificate type
Choose your uploaded certificate
Deploy

Using the API

Create Certificate

curl -X POST https://your-dokploy-instance.com/api/certificates.create \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "example-com-cert",
    "certificateData": "-----BEGIN CERTIFICATE-----\n...",
    "privateKey": "-----BEGIN PRIVATE KEY-----\n..."
  }'

Certificate Format

Certificates must be in PEM format:

certificate.crt

-----BEGIN CERTIFICATE-----
MIIFXzCCBEegAwIBAgISA1...
...
-----END CERTIFICATE-----

private.key

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQ...
...
-----END PRIVATE KEY-----

Never commit private keys to version control. Store them securely using environment variables or secret management tools.

Wildcard Certificates

Secure all subdomains with a single certificate:

Using Let’s Encrypt

Configure DNS-01 challenge (see above)
Add domain as *.example.com
Dokploy requests wildcard certificate

Using Custom Certificate

Obtain wildcard certificate from your CA
Upload to Dokploy
Use for all subdomains

Example Usage

services:
  app1:
    labels:
      - "traefik.http.routers.app1.rule=Host(`app1.example.com`)"
      - "traefik.http.routers.app1.tls=true"
  
  app2:
    labels:
      - "traefik.http.routers.app2.rule=Host(`app2.example.com`)"
      - "traefik.http.routers.app2.tls=true"

Both apps use the same *.example.com certificate.

Certificate Management

View Certificates

List Certificates

curl https://your-dokploy-instance.com/api/certificates.all \
  -H "Authorization: Bearer YOUR_API_KEY"

Update Certificate

Via Dashboard
Via API

Go to Settings → Certificates
Click on the certificate
Upload new certificate/key
Save changes

curl -X POST https://your-dokploy-instance.com/api/certificates.update \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "certificateId": "cert-id",
    "certificateData": "...",
    "privateKey": "..."
  }'

Certificate Renewal

Let's Encrypt Auto-Renewal

Dokploy automatically renews Let’s Encrypt certificates:

Renewal starts 30 days before expiration
Multiple retry attempts if renewal fails
Email notifications on renewal failure
Zero downtime during renewal

Custom Certificate Renewal

For custom certificates:

Obtain renewed certificate from your CA
Update in Dokploy (via dashboard or API)
Traefik hot-reloads without downtime

Set up monitoring alerts 30 days before expiration.

SSL/TLS Best Practices

Use Strong Ciphers

Configure Traefik with modern TLS 1.2+ and strong cipher suites

Enable HSTS

Force HTTPS with HTTP Strict Transport Security headers

Certificate Monitoring

Set up alerts for certificate expiration

Rotate Regularly

For custom certs, rotate annually or when compromised

Traefik TLS Configuration

traefik-static.yml

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

HSTS Configuration

Add HSTS headers to force HTTPS:

docker-compose.yml

services:
  app:
    labels:
      - "traefik.http.middlewares.hsts.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.hsts.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.hsts.headers.stsPreload=true"
      - "traefik.http.routers.app.middlewares=hsts"

Troubleshooting

Let's Encrypt rate limit exceeded

Let’s Encrypt limits:

50 certificates per registered domain per week
5 duplicate certificates per week

Solutions:

Use staging environment for testing
Use wildcard certificates
Wait for rate limit reset (weekly)
Consider custom certificates

HTTP-01 challenge fails

Common causes:

DNS not pointing to your server
Port 80 blocked by firewall
Traefik not accessible on port 80
Domain resolving to wrong IP

Verify:

curl http://your-domain.com/.well-known/acme-challenge/test

Certificate not trusted

For custom certificates:

Include complete certificate chain
Verify certificate validity: openssl x509 -in cert.crt -text -noout
Check certificate matches domain
Ensure root CA is trusted

SSL handshake errors

Verify TLS version compatibility
Check cipher suite support
Review Traefik logs: docker logs traefik
Test with: openssl s_client -connect domain:443

Certificate renewal fails

Check Traefik logs:

docker logs traefik | grep -i acme

Common issues:

DNS propagation delays
API credentials expired (DNS-01)
Rate limits
Network connectivity

Security Considerations

Critical Security Practices:

Never expose private keys
Use strong key sizes (2048-bit RSA minimum, 256-bit ECDSA)
Rotate certificates before expiration
Monitor certificate validity
Use Let’s Encrypt when possible (automatic rotation)
Enable OCSP stapling for revocation checking

Overview

Getting Started

Core Concepts

Deployments

Databases

Monitoring & Observability

Advanced Features

Configuration

CLI & Automation

Community & Support

​Overview

Automatic SSL

Custom Certificates

Wildcard Support

​SSL Certificate Types

​Let’s Encrypt Configuration

​Automatic HTTPS (HTTP-01 Challenge)

​DNS-01 Challenge (Wildcard Certificates)

​Supported DNS Providers

​Custom Certificates

​Upload Certificate

​Using the API

​Certificate Format

​Wildcard Certificates

​Using Let’s Encrypt

​Using Custom Certificate

​Certificate Management

​View Certificates

​Update Certificate

​Certificate Renewal

​SSL/TLS Best Practices

Use Strong Ciphers

Enable HSTS

Certificate Monitoring

Rotate Regularly

​Traefik TLS Configuration

​HSTS Configuration

​Troubleshooting

​Security Considerations

​Certificate Security Checklist

​Next Steps

Domains & Routing

Security

Traefik

Monitoring

Build docs developers (and LLMs) love

Overview

SSL Certificate Types

Let’s Encrypt Configuration

Automatic HTTPS (HTTP-01 Challenge)

DNS-01 Challenge (Wildcard Certificates)

Supported DNS Providers

Custom Certificates

Upload Certificate

Using the API

Certificate Format

Wildcard Certificates

Using Let’s Encrypt

Using Custom Certificate

Certificate Management

View Certificates

Update Certificate

Certificate Renewal

SSL/TLS Best Practices

Traefik TLS Configuration

HSTS Configuration

Troubleshooting

Security Considerations

Certificate Security Checklist

Next Steps