Let’s Encrypt SSL

Let’s Encrypt SSL Certificates

Let’s Encrypt is a free certificate authority that issues domain-validated SSL/TLS certificates. The platform add-on automates certificate requesting, installation, deployment to the selected stack, and renewal before expiration.
Let’s Encrypt SSL illustration
Let’s Encrypt provides free domain-validated SSL certificates.
On this page

Supported Stacks

Load BalancersNGINX, Apache Load Balancer, HAProxy, and Varnish.
Java ServersTomcat, TomEE, GlassFish, Payara, and Jetty.
PHP ServersApache PHP and NGINX PHP.
Ruby ServersApache Ruby and NGINX Ruby.
For other stacks, place a load balancer in front of the application servers and install the add-on on that layer. Node.js uses a separate stack-specific procedure.

How It Works

  • The add-on installs and configures the Certificate Management Agent.
  • The agent requests a certificate from the Let’s Encrypt certificate authority.
  • Domain ownership is verified through HTTP on port 80.
  • Validation traffic is redirected temporarily to port 12345, where the CMA proxy runs.
  • For multi-node layers, requests are sent to the master node.
  • Temporary DNAT rules are removed after successful validation.
  • The issued certificate is propagated to all nodes in the entry-point layer.
  • A cron job is added for automatic renewal.
Let’s Encrypt domain validation
Temporary routing sends validation requests to the Certificate Management Agent.

Install the Add-On

1Open Marketplace

Open Marketplace, switch to the Add-ons tab, find Let’s Encrypt Free SSL, and click Install.

Let’s Encrypt add-on in Marketplace
Install the Let’s Encrypt Free SSL add-on from Marketplace.

2Configure certificate details

Enter the external domains, select the target environment, and choose the entry-point node layer.

  • Leave External Domain(s) blank to create a test certificate for the internal environment URL.
  • Enter already-linked external domains to obtain trusted certificates.
  • Separate multiple domains with spaces, commas, or semicolons.
  • Select the target environment and node layer.
Let’s Encrypt SSL add-on installation
Configure the domains, environment, and entry-point layer.
Multiple external domains
Specify several domains in one installation request.
Public IP requirement: The add-on requires a public IP. If the target node has none, one is attached automatically. Public IP is a paid option.

3Confirm certificate activation

After installation, open Settings > Custom SSL to verify that HTTPS is active and review the expiration date.

Custom SSL active
Confirm certificate activation and expiration date.
Application available over HTTPS
Verify that the application opens through a trusted HTTPS connection.

Install through API

curl -X POST 'https://{hoster_domain}/1.0/marketplace/jps/rest/install' \
  -d session={session} \
  -d jps=letsencrypt-ssl-addon \
  -d envName={your_env_name} \
  -d nodeGroup={your_node_group} \
  --data-urlencode settings='{your_addon_settings}'

Common add-on settings include customDomains, nodeGroup, nodeId, webroot, webrootPath, fallbackToX1, deployment hooks, undeployment hooks, and test mode.

Update Certificates

Let’s Encrypt certificates are valid for 90 days. Renewal is checked daily and normally starts automatically 30 days before expiration. An email notification is also sent.

To renew manually, open the add-on panel and click Update Now.

Update Let’s Encrypt certificate
Force certificate renewal through the Update Now action.
curl -X POST 'https://{hoster_domain}/1.0/marketplace/installation/rest/executeaction' \
  -d session={session} \
  -d appUniqueName={app_unique_name} \
  -d action=update

Reconfigure Domains

Click Configure in the add-on panel to add or remove external domains.

Configure Let’s Encrypt add-on
Open the add-on configuration.
Configure external domains
Change the list of domains protected by the certificate.
A new certificate is issued even when domains are only removed from the existing certificate.
curl -X POST 'https://{hoster_domain}/1.0/marketplace/installation/rest/executeaction' \
  -d session={session} \
  -d appUniqueName={app_unique_name} \
  -d action=configure \
  --data-urlencode params='{"customDomains":"{your_new_domain_list}"}'

Remove the Add-On

Open the add-on menu and click Uninstall. After confirmation, the add-on is removed and the attached certificates are deactivated.

Uninstall Let’s Encrypt add-on
Remove the add-on and deactivate its certificates.

What’s next?