A certificate without thinking about it
ToutWAF orders a site's certificate, installs it on your nodes without interrupting a handshake and renews it 30 days before it expires.
Certificates and TLS
Certificates ordered and renewed automatically from the authority of your choice, modern TLS, HTTP/2 and your own certificates. ToutWAF checks your DNS before ordering, so your attempts are not wasted.
Where to find it in the console : Infrastructure menu: Certificates (the « Sites without a certificate » block and the ACME settings); the go-live assistant and ToutWAF Doctor.
What it is for
Orders that do not fail for nothing
Before contacting the authority, ToutWAF checks the node, port 80 and your A and AAAA records. An order that is bound to fail is not sent.
The authority of your choice
Let's Encrypt, ZeroSSL, Google Trust Services or SSL.com. With a licence: fallback authorities and any ACME directory, paid or internal.
Your certificates and modern TLS
Import your own, choose TLS 1.2 and 1.3 or 1.3 only, OCSP stapling, HSTS, mutual TLS and HTTP/2.
From domain name to installed certificate
The control plane orders and stores the certificate; the nodes fetch it regularly and load it on the fly.
Checks before the order
A node is enrolled and online, a policy is published, port 80 listens, and every A and AAAA record of the name leads to this ToutWAF.
HTTP-01 or DNS-01 challenge
HTTP-01 proves the name leads here through port 80. DNS-01 is for wildcards (*.example.com) and when your provider blocks port 80.
Hot installation and renewal
Nodes fetch certificates every 60 seconds. The server name picks the right certificate through SNI, with no restart.
The classic trap: IPv6 and CDN
Browsers and authorities try IPv6 first. An AAAA record left at a CDN makes the order fail with an error that never mentions DNS. ToutWAF looks at both address families.
- A name that does not resolve, a record that points elsewhere or a private address: the check says so and proposes what to do.
- An AAAA record that belongs to a proxy while the A record points here is recognised (Cloudflare for example): delete the AAAA or turn the proxy off for the order, or use DNS-01.
- The optional test from the Internet has the Let's Encrypt test server try your site, without keeping a certificate.
- Nothing about your visitors or the content of your pages is sent.
Choose the certificate authority
مجانيPro وما فوق
One public authority of your choice is free. Fallback options and paid or internal directories require a licence.
- Free: Let's Encrypt (default), ZeroSSL, Google Trust Services or SSL.com. The last three need an account key (EAB) that you create with them.
- Licence required: up to three fallback authorities, tried in order when the first cannot issue (rate limit, outage, refused account, CAA record).
- Licence required: another ACME directory, paid (Sectigo, DigiCert...) or internal (step-ca, Vault PKI).
- ToutWAF reads the CAA records of the domain and skips the authorities it does not name. A validation that fails does not switch authority.
لم تُجرَّب بعد في ظروف حقيقيةThe directories of the four authorities were read live, but ordering, switching authority and the CAA check were tried against a simulated ACME server.
DNS-01 and wildcard certificates
ToutWAF does not manage your DNS zone: it tells you what to create and checks it.
- With a DNS webhook, the control plane sends it the TXT record to put in place and then remove.
- Without a webhook, manual mode shows the TXT record to create and waits for it to appear, up to ten minutes.
- On a standalone node, DNS-01 can also call Cloudflare, OVH or Route 53, or run your command.
- Try the authority's test environment first to avoid its rate limits.
لم تُجرَّب بعد في ظروف حقيقيةThe DNS providers were not tried with real calls.
Your own certificates
مجاني
Import a certificate and its key in PEM format, or drop the files in the intended folder.
- Certificates are reloaded without a restart or interrupted handshake; the choice is made through SNI from the certificate names.
- Private keys are never returned by the API.
- Before the first certificate, a site is served over plain HTTP; it is redirected to HTTPS only once a real certificate is installed.
TLS and protocols
مجاني
Sober settings, with reasonable defaults.
- Intermediate profile (TLS 1.2 and 1.3) or modern profile (TLS 1.3 only).
- HTTP/1.1 and HTTP/2 to visitors; HTTP/2 or h2c to the origin. WebSocket, server-sent events (SSE) and gRPC go through the proxy.
- OCSP stapling, HSTS, and mutual TLS: visitors' client certificates, and a certificate presented to the origin.
- An alert warns 14 days before a certificate expires.
What is not done, or not proven
We prefer to say it plainly.
- HTTP/3 (QUIC) is not offered, nor is post-quantum key exchange or ECH.
- Orders with real authorities and DNS providers have not yet been tried in real conditions: order the first certificate for a site that can wait, and read the task log.
- ToutWAF does not manage your DNS and creates no record: it tells you which ones to create.
- Certificates are public by design: the names they contain are visible to everyone, whatever the tool.
Use cases
Put a new site on HTTPS
DNS is checked, the certificate is ordered when everything is green, then the redirect to HTTPS turns on.
Protect *.example.com
A wildcard certificate through DNS-01, with a DNS webhook or in manual mode.
An existing enterprise certificate
You import your internal authority's certificate; it is reloaded on the fly when you replace it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
الإصدارمجاني مشمول في جميع العروض، ومنها العرضان المجانيان (Free وFree +)Pro وما فوق العروض المدفوعة: ظاهرة في وحدة التحكم ومقفلة دون ترخيص. ابتداءً من Pro ما لم يُذكر Agency أو Enterprise
لم تُجرَّب بعد في ظروف حقيقية تعمل في اختبارات المنتج، لكنها لم تُجرَّب بعد مع الخدمة أو النظام أو العتاد الحقيقي. تعرض وحدة التحكم الملاحظة نفسها في المكان الذي تضبط فيه الوظيفة.
- TLS 1.2 و1.3 (الملف المتوسط) أو TLS 1.3 فقط (الملف الحديث)مجاني
- HTTP/1.1 وHTTP/2 نحو الزوّار، وHTTP/2 أو h2c نحو الخادم الأصلي (HTTP/3 غير متاح)مجاني
- شهادات تلقائية من جهة واحدة تختارها: Let's Encrypt أو ZeroSSL أو Google Trust Services أو SSL.com لم تُجرَّب بعد في ظروف حقيقيةمجاني
- تحديات HTTP-01 وDNS-01، والتجديد قبل 30 يوماً من الانتهاءمجاني
- فحوص قبل الطلب: سجلات A وAAAA، واكتشاف CDN، وإمكانية الوصول إلى المنفذ 80مجاني
- شهاداتك الخاصة، تُعاد تحميلها دون قطع أي مصافحةمجاني
- OCSP stapling وHSTSمجاني
- TLS المتبادل: شهادات العميل من الزوّار ونحو الخادم الأصليمجاني
- وكيل WebSocket والأحداث المرسَلة من الخادم (SSE) وgRPCمجاني
- عدة جهات إصدار مع تبديل تلقائي، ودلائل ACME مدفوعة وداخلية لم تُجرَّب بعد في ظروف حقيقيةPro وما فوق
العودة إلى القيمة الافتراضية لخيار متقدم ممكنة دائماً. ما يحدث عند انتهاء ترخيص مدفوع موصوف في الأسئلة الشائعة عن الأسعار: 48 ساعة سماح، ثم 48 ساعة للقراءة فقط، ثم تُعطَّل حماية WAF حتى التجديد.
الأسعار Read the documentation
ضع درعاً أمام تطبيقاتك اليوم
ثبّته على خادمك الخاص، أو راسلنا للحديث عن التراخيص.