Add a custom domain and SSL

Every environment has a default address. You can also serve it under your own domain, such as www.example.com, and protect that domain with an SSL certificate so visitors use HTTPS.

Open Domains & SSL

1. Open the environment, then select Tools.
2. Select Domains & Certificates. The Domains & SSL section opens.

Add your domain

1. Note the DNS Target. It’s the address your domain must point at.
2. In Custom Domains, select Add Domain.
3. Type the Domain, for example www.example.com.
4. Under Certificate (Optional), choose a certificate you already uploaded, or Add Without a Certificate for Now.
5. Select Add Domain. You see Domain added.
6. At your DNS provider, create a CNAME record for the domain with the DNS Target as its value. A root domain such as example.com can’t use a CNAME. Add an A record that points to your web layer’s public IP instead, shown under Resources.

Adding the domain in Lighthouse doesn’t change your DNS. The domain works once your DNS record is in place.

The Custom Domains table lists each domain with its Type (Default for the built-in address, Custom for yours) and its SSL state.

Get a free certificate

The Let’s Encrypt SSL add-on gives free certificates that renew by themselves. Your domain must already point at the public IP of the layer it’s installed on.

1. In the Free SSL With Let’s Encrypt card, select Get a Free Certificate.
2. Install the add-on on your web layer, and enter your domain in its form. See Install an add-on.

Once installed, the card reads Let’s Encrypt SSL Is Installed. It shows the domains it covers and when the current certificate expires. Select Open Add-on to add a domain.

Upload your own certificate

1. In SSL Certificates, select Upload Certificate.
2. Paste the Certificate (PEM) and the Private Key (PEM). Add the Intermediate / CA Bundle (Optional, PEM) if your provider gave you one.
3. Select Upload Certificate. You see Certificate uploaded.
4. In Custom Domains, select the bind button on your domain’s row.
5. Choose the Certificate, then under Apply To pick This Domain Only or All Domains on This Environment.
6. Select Bind Certificate.

The SSL Certificates table lists each certificate with Issued By, Type, the domains it Covers and when it Expires. Expiring Soon and Expired warn you to renew it.

Remove a domain or a certificate

• To stop serving a domain, select its remove button and confirm Remove.
• To take SSL off a domain, select Remove SSL. Visitors using https:// see a connection error until you bind a certificate again.
• To delete a certificate, select its remove button. Any domain still using it loses SSL at once.

If something goes wrong

• This domain is already bound elsewhere. Choose a different one.
• This environment has no web-facing layer, so it can’t take a custom domain. Add an Application Node or Load Balancer layer first.
• That certificate could not be uploaded — check the key and certificate are valid PEM text. Paste the full text, including the BEGIN and END lines.
• Only the workspace owner can manage domains and certificates.