Certificates

serverCertificates, addServerCertificate and removeServerCertificate manage a host's own TLS certificates: instance-admin only, since they front whatever any team runs on that server. They live in that host's proxy rather than in Deplo, and the private key is write-only, there is no read path back.

A domain reaches a custom certificate by setting Domain.certProvider to custom, HTTPS with no ACME resolver named. Unlike letsencrypt, that draws on no shared account and is therefore not capped per team.

See also