Choose one termination boundary
| Boundary | Use when | You own |
|---|---|---|
| Reverse proxy/load balancer | Your platform already manages certificates, HTTP policy, and rotation. | Trusted proxy configuration, private upstream traffic, redirects, headers, renewal, and edge health. |
| Daptin HTTPS listener | Daptin directly serves a hostname and its enabled certificate. | Certificate records/files, key protection, port exposure, SNI selection, renewal, and restart/reload behavior. |
Do not terminate TLS at two unrelated public layers or expose a plaintext upstream on an untrusted network. Document which component redirects HTTP, owns HSTS/security headers, and renews each hostname.
Prepare names, DNS, ports, and keys
- List every public hostname and point DNS at the intended edge.
- Permit the validation and HTTPS ports required by the chosen certificate workflow.
- Issue a certificate whose subject alternative names cover the exact hosts.
- Store private keys with restrictive permissions and never commit them to the repository or image.
- Associate each Daptin-served site with the matching enabled certificate when Daptin terminates TLS.
Verify the client-visible result
openssl s_client -connect app.example.com:443 \
-servername app.example.com -showcerts
curl --fail --show-error --head https://app.example.com/Check the hostname, complete chain, issuer, validity window, negotiated protocol, redirect behavior, and the exact virtual host returned through SNI. Repeat for every hostname, including a host that should not match. Test from outside the deployment network.
Monitor renewal before expiry
Alert far enough before expiry to fix DNS, account, rate-limit, or permission failures. Exercise renewal in staging, verify that the serving process reloads the new certificate, and keep an operator procedure for emergency replacement and revocation.