HTTPS and TLS

Easel serves every hostname over HTTPS and manages the certificates for you. You never upload certificate files or private keys.

What's covered

• Deployment and preview URLs under preview.easelusercontent.com use a platform wildcard certificate, so HTTPS works as soon as the URL exists.
• Custom domains get their own Let's Encrypt certificate after DNS points at Easel. Redirect domains get one too, so visitors don't see a certificate warning before the redirect.

Each hostname needs its own certificate. Adding example.com doesn't cover www.example.com or api.example.com; add each hostname you serve. Wildcard certificates for custom domains and uploaded certificates aren't supported.

Certificate details

Issuance

1. You add the domain and configure DNS.
2. Easel verifies DNS, and the domain shows Issuing certificate.
3. Easel requests the certificate on the first HTTPS request to the hostname. The dashboard's own check makes that request, so you don't need to send traffic.
4. The domain shows Live once HTTPS works.

HTTPS connections to the hostname fail until issuance finishes. If issuance fails, for example because Let's Encrypt still sees old DNS records, Easel retries automatically and waits longer after each failed attempt, up to an hour. If a domain stays stuck, check its status and last error in the dashboard rather than removing and re-adding it. See Troubleshooting.

Renewal

Easel renews certificates in the background, without a new deployment, as long as:

• The domain stays assigned to the project
• DNS still points at Easel
• HTTP-01 validation can reach Easel
• CAA records still permit Let's Encrypt

An existing certificate keeps working for a while after DNS breaks, but renewal won't succeed. When a check finds the record missing, the domain returns to Needs DNS records and renewal stops until you fix DNS. Easel doesn't email renewal failures.

HTTP to HTTPS redirect

Easel redirects plain HTTP requests to HTTPS with a 301, keeping the path and query string. Your app doesn't need to handle it.

http://example.com/products?page=2 → https://example.com/products?page=2

Requests to /.well-known/acme-challenge/ aren't redirected, so certificate validation keeps working.

HSTS

Easel sends this header on every response:

Strict-Transport-Security: max-age=63072000

It tells browsers to use HTTPS for the hostname for two years. If you set a stricter policy yourself, be deliberate: includeSubDomains applies to every subdomain, including ones not hosted on Easel, and browser preload lists are hard to leave. For other response headers, see Security headers.

CAA records

CAA records limit which certificate authorities can issue for your domain. If you have any, they must permit Let's Encrypt, or issuance and renewal fail:

example.com. CAA 0 issue "letsencrypt.org"

Check CAA on both the exact hostname and its parent domain.

DNS proxies

A proxy such as Cloudflare's orange cloud sits in front of Easel and can change verification, certificate issuance, redirects, caching, client IPs, and security rules.

• Keep the record DNS-only until the domain is Live. A proxied record returns the proxy's addresses instead of Easel's, so verification fails, and the proxy can intercept HTTP-01 validation.
• If you turn the proxy on afterward, have it connect to Easel over HTTPS. A proxy that connects over HTTP while both sides force HTTPS causes redirect loops.
• Remove proxy redirect and cache rules that conflict with Easel's.

Check HTTPS

curl -I https://example.com
curl -I http://example.com
openssl s_client -connect example.com:443 -servername example.com

The first should succeed without a certificate error, and the second should redirect to HTTPS. -servername sends the hostname during the TLS handshake, so you see the certificate Easel serves for it.