HTTPS

With two options, ferryd gets a certificate for each public hostname and renews it.

A public hostname gets a route. The route table wakes the certificate loop of ferry-tls.

1 / 5

HTTPS needs two options of ferryd: --https-addr and --acme-email. With them, the proxy also does the TLS work.

The certificates come from Let’s Encrypt, through ACME with the HTTP-01 challenge.

The rules

Case	What the proxy does
A plain HTTP request to a host that has a certificate	It answers `308`: a redirect to HTTPS.
A local hostname: `*.localhost`, `.local`, `.internal`, `.test`, or an IP address	The host never gets a certificate. It stays on HTTP.

For the full setup, see Custom domains and HTTPS.

Verify a domain

The engine makes sure that a connected domain reaches this ferryd process before Ferry serves it.

Security model

One administrator controls the full server. Only the proxy is open to the internet.