Certificates

Manage the mTLS and public domain certificates the deployment depends on.

Last updated Aug 14, 2026View as Markdown

Overview

Certificates is the inventory of every certificate the panel knows about, split into internal mTLS certificates and public domain certificates. It exists so certificate expiry never surprises you: you can see what is issued, what is about to lapse, and renew or revoke without leaving the panel. The panel also publishes seconds-until-expiry per domain as a Prometheus metric, so you can alert on it externally.

Before you start

  • Public certificates issued through ACME renew automatically when ACME_AUTO_RENEW is on; you should rarely need to renew one by hand here.
  • Revoking is not the same as deleting. Revoke invalidates the certificate; delete only removes the record.

Steps

  1. Open Certificates from the sidebar.
  2. Switch between the Internal and Public tabs depending on which set you are working on.
  3. Search by name, or scan the stats row at the top for the shape of the inventory.
  4. Switch between List View and Timeline View, where the timeline lays certificates out by expiry, which is the faster way to spot what lapses next.
  5. Click a certificate to open its details.
  6. Use Select Multiple to act on several certificates at once.
  7. Issue a new certificate, or renew, revoke or delete an existing one. Each of these asks for confirmation.

Reference

Tab What it holds
Internal mTLS certificates used inside the deployment.
Public Certificates for your public domains.
Action Effect
Issue Requests a new certificate.
Renew Re-issues an existing certificate before it expires.
Revoke Invalidates the certificate.
Delete Removes the certificate record.

A banner at the top of the page reports the certificate authority’s status when there is something to say about it.