# SSL certificates

Source : https://webgune.cloud/en-us/docs/certificats-ssl · Mis à jour le 2026-10-27

# SSL certificates

Certificates are issued and renewed by **ZeroSSL**, automatically: nothing to request, nothing to install, nothing to watch.

## Workflow

1. A domain is added to a service. The matching route is created on the platform's router.
2. A cluster component watches for new routes and picks one up in under a minute. It is the one that requests the certificate from ZeroSSL.
3. ZeroSSL verifies, via an HTTP request to your domain, that it really points to Webgune's infrastructure.
4. The certificate is installed on the route, then renewed automatically before it expires.

## Expected delays

| Domain | Delay |
|---------|-------|
| `*.webgune.dev` | immediate (preconfigured wildcard) |
| custom domain, DNS already propagated | about 2 minutes |
| custom domain, DNS not yet propagated | up to 24h after propagation |

## Diagnosing a blockage

**The certificate is not being generated:**
- check that DNS really points to the IP provided by Webgune, using a tool like [dnschecker.org](https://dnschecker.org);
- if Cloudflare is in use, disable the orange proxy on the relevant record: while traffic goes through it, ZeroSSL's HTTP check cannot reach our servers and the certificate will never be issued;
- wait until the end of the propagation window before concluding something is wrong.

**The browser still shows "Not secure":**
- force a reload without cache (`Ctrl+Shift+R`);
- check the **DNS OK, SSL active** badge in the service's Domains tab. If it is not green, the certificate has not been issued yet.

If the blockage persists while DNS has been correct for several hours, open a [ticket](/docs/tickets-support): a manual reissue is possible on the platform side.