How SSL Certificates Work on Staq

By default, Staq utilizes Let’s Encrypt for managing SSL certificates, including both creation and automatic renewals.

We also support the ability for you to upload a custom SSL certificate.

This guide explains how the system works, the requirements for successful SSL generation, and what to do if you encounter issues.

How Staq’s SSL System Works

• SSL Certificate Creation: Staq generates SSL certificates using Let’s Encrypt, ensuring secure connections for your website. Lets Encrypt’s uses 256-bit encryption.
• Automatic Renewals: SSL certificates are automatically renewed one week before their expiration date, which occurs every three months.
• DNS Requirements: For Let’s Encrypt to create or renew an SSL certificate, the A records for your domain must point to Staq. This means proxy cannot be enabled but there’s a Cloudflare exception if you integrate it into Staq.

Proxy and SSL Generation

If the A records are proxied to hide the server IP address, SSL generation or renewal will fail. However, there is an exception:

• Cloudflare Integration: If you use Cloudflare and want to enable proxying, you can set up Cloudflare integration on Staq. This integration allows seamless SSL generation and renewal, provided the Cloudflare API is configured to manage your domain.
• For instructions on setting up Cloudflare integration, refer to this guide: Integrating Cloudflare with Staq.

CAA Records

If your DNS includes a CAA record, ensure it allows Let’s Encrypt (or another provider if you use our custom SSL uploader) as a trusted SSL generator. Without this configuration, SSL generation will fail. For more details, follow this guide: Steps to Minimize or Avoid Downtime When Taking a Website Live.

Lets Encrypt Verification Process

For Let’s Encrypt to generate an SSL certificate:

• The A records must first point to Staq, as SSL certificates cannot be pre-generated before the DNS is correctly configured.

When you need to create an SSL certificate before going live

• This is the guide on how to create a brand new SSL certificate, including CSR.
• If you wish to use a managed SSL provider like ZeroSSL, you can generate the SSL certificate and refer to this guide on How to Add a Custom SSL.

Please note that if you go down the manual SSL certificate path, you will be responsible to manually renew the certificate each time.

We Support Custom SSL Certificates

We support custom SSL certificate installation as a DIY method. For instructions on uploading a custom SSL certificate, refer to this guide: How to Add a Custom SSL.

Conclusion

By ensuring that your DNS records are correctly configured and following the steps outlined above, you can easily manage SSL certificates on Staq. For advanced configurations like using Cloudflare or adding CAA records, refer to the respective guides linked in this document.