HTTPS and TLS for custom domains
Learn how Easel provisions and renews certificates for custom domains.
Easel serves custom domains over HTTPS using TLS certificates from Let's Encrypt.
After DNS points to Easel, Easel requests and installs a certificate for the hostname using HTTP-01 validation.
Certificate lifecycle
A typical certificate lifecycle is:
- Domain added
- DNS configuration detected
- Certificate requested (HTTP-01)
- Certificate issued
- HTTPS enabled
- Certificate renewed before expiration
The dashboard shows DNS and TLS progress through domain statuses such as Invalid DNS configuration, Provisioning SSL certificate, and Valid Configuration.
Automatic HTTPS
When certificate provisioning succeeds, Easel:
- Serves the domain over HTTPS
- Redirects HTTP to HTTPS (except ACME challenge paths)
- Renews the certificate automatically while DNS remains correct
- Replaces certificates without requiring a new deployment
HTTP-to-HTTPS redirection is enabled for known hosts when TLS is active.
Certificate coverage
A certificate must cover each hostname that serves traffic.
These are separate names:
Adding example.com does not automatically configure www.example.com. Add each hostname you need.
Wildcard certificates for customer domains are not available. See Wildcard domains.
Provisioning requirements
Certificate issuance can fail when:
- DNS does not point to Easel
- A proxy intercepts the HTTP-01 validation response
- CAA records block Let's Encrypt
- A conflicting domain assignment exists
- DNSSEC is broken
- Let's Encrypt rate-limits issuance
- The hostname fails validation rules
Prefer DNS-only mode at your DNS provider until the certificate is live. See DNS configuration.
CAA records
If the domain has CAA records, permit Let's Encrypt:
Certificate renewal
Renewal runs automatically in the background while:
- The domain remains assigned
- DNS continues routing correctly
- HTTP-01 validation remains possible
- CAA records permit Let's Encrypt
A domain can continue working temporarily with an existing certificate even after DNS becomes invalid. That does not mean renewal will succeed. Easel does not currently email certificate renewal failures; watch domain status in the dashboard.
Custom certificates
Easel-managed certificates are required for custom domains. Uploading your own certificate and private key is not supported.
Removing a domain
Removing a domain stops Easel from serving it after routing state updates (edge manifests refresh within about 30s).
The certificate may remain in internal systems until cleanup completes, but the hostname is no longer assigned to the project.