Domains, DNS & SSL

Domains and aliases

A site has one primary domain and up to ten aliases. All of them are served by the same Nginx vhost and covered by the site's certificate. Edit aliases under the site’s Settings, SSL. Changing them updates the vhost without a redeploy, and new names are covered once the certificate is re-issued.

DNS

Any DNS provider works. Point an A record at the server's IPv4 address. If you connect a Cloudflare API token under Settings, Connections, Integrations, Provisore can create that record when you create the site, and use the same token for DNS-01 certificate validation.

• The token must be zone-scoped. Cloudflare's "Edit zone DNS" template is the right one. A token with account-level permissions is rejected, and a Global API Key should not be used.
• Provisore creates only A and TXT records, unproxied.
• Record creation is idempotent. An existing record for the same name is updated in place, and one already holding the right value is left alone.
• Deleting the site, or choosing Stop managing, removes a record Provisore created and puts an existing record it updated back to its earlier value. Either happens only if the record still holds the value Provisore wrote.
• A DNS failure does not fail site creation. The site is created and you can retry the record from its Settings, DNS.
• The token stays in Provisore and is never written to your server. Certbot's renewal hooks call back to Provisore to publish the challenge record.

Removing the token is refused while sites still use it for managed records or DNS-01 validation, because certificate renewal would fail later. You can force it, which drops the managed record entries in Provisore and leaves the records in place at Cloudflare.

Certificates

Certbot, installed during provisioning, issues every certificate. The site must have been deployed at least once.

• HTTP-01 is the default. Validation happens over port 80, so the domain must already resolve to the server. No DNS provider is needed.
• DNS-01 works before the domain resolves to the server, and is required for a wildcard certificate (*.example.com). It needs a connected DNS provider whose token can see a zone covering the domain.

Changing the challenge type applies to the next issuance. The installed certificate keeps renewing the way it was issued. After issuance, the vhost is rendered from Provisore's template rather than certbot's, so the SSL block and the HTTP to HTTPS redirect follow your site settings.

Deactivating a certificate returns the vhost to HTTP-only and removes the certificate from the server. You can issue a new one afterwards.

Renewal

Certbot renews on the server. Provisore separately reads the certificate's real expiry date and notifies you when an active certificate is close to expiring, or when a renewal has not happened in time. The events are certificate.expiring and certificate.renewal_failed on your notification channels.