A certificate without thinking about it
ToutWAF orders a site's certificate, installs it on your nodes without interrupting a handshake and renews it 30 days before it expires.
Certificates and TLS
Certificates ordered and renewed automatically from the authority of your choice, modern TLS, HTTP/2 and your own certificates. ToutWAF checks your DNS before ordering, so your attempts are not wasted.
Where to find it in the console : Infrastructure menu: Certificates (the « Sites without a certificate » block and the ACME settings); the go-live assistant and ToutWAF Doctor.
What it is for
Orders that do not fail for nothing
Before contacting the authority, ToutWAF checks the node, port 80 and your A and AAAA records. An order that is bound to fail is not sent.
The authority of your choice
Let's Encrypt, ZeroSSL, Google Trust Services or SSL.com. With a licence: fallback authorities and any ACME directory, paid or internal.
Your certificates and modern TLS
Import your own, choose TLS 1.2 and 1.3 or 1.3 only, OCSP stapling, HSTS, mutual TLS and HTTP/2.
From domain name to installed certificate
The control plane orders and stores the certificate; the nodes fetch it regularly and load it on the fly.
Checks before the order
A node is enrolled and online, a policy is published, port 80 listens, and every A and AAAA record of the name leads to this ToutWAF.
HTTP-01 or DNS-01 challenge
HTTP-01 proves the name leads here through port 80. DNS-01 is for wildcards (*.example.com) and when your provider blocks port 80.
Hot installation and renewal
Nodes fetch certificates every 60 seconds. The server name picks the right certificate through SNI, with no restart.
The classic trap: IPv6 and CDN
Browsers and authorities try IPv6 first. An AAAA record left at a CDN makes the order fail with an error that never mentions DNS. ToutWAF looks at both address families.
- A name that does not resolve, a record that points elsewhere or a private address: the check says so and proposes what to do.
- An AAAA record that belongs to a proxy while the A record points here is recognised (Cloudflare for example): delete the AAAA or turn the proxy off for the order, or use DNS-01.
- The optional test from the Internet has the Let's Encrypt test server try your site, without keeping a certificate.
- Nothing about your visitors or the content of your pages is sent.
Choose the certificate authority
KostenlosPro und höher
One public authority of your choice is free. Fallback options and paid or internal directories require a licence.
- Free: Let's Encrypt (default), ZeroSSL, Google Trust Services or SSL.com. The last three need an account key (EAB) that you create with them.
- Licence required: up to three fallback authorities, tried in order when the first cannot issue (rate limit, outage, refused account, CAA record).
- Licence required: another ACME directory, paid (Sectigo, DigiCert...) or internal (step-ca, Vault PKI).
- ToutWAF reads the CAA records of the domain and skips the authorities it does not name. A validation that fails does not switch authority.
Noch nicht unter realen Bedingungen erprobtThe directories of the four authorities were read live, but ordering, switching authority and the CAA check were tried against a simulated ACME server.
DNS-01 and wildcard certificates
ToutWAF does not manage your DNS zone: it tells you what to create and checks it.
- With a DNS webhook, the control plane sends it the TXT record to put in place and then remove.
- Without a webhook, manual mode shows the TXT record to create and waits for it to appear, up to ten minutes.
- On a standalone node, DNS-01 can also call Cloudflare, OVH or Route 53, or run your command.
- Try the authority's test environment first to avoid its rate limits.
Noch nicht unter realen Bedingungen erprobtThe DNS providers were not tried with real calls.
Your own certificates
Kostenlos
Import a certificate and its key in PEM format, or drop the files in the intended folder.
- Certificates are reloaded without a restart or interrupted handshake; the choice is made through SNI from the certificate names.
- Private keys are never returned by the API.
- Before the first certificate, a site is served over plain HTTP; it is redirected to HTTPS only once a real certificate is installed.
TLS and protocols
Kostenlos
Sober settings, with reasonable defaults.
- Intermediate profile (TLS 1.2 and 1.3) or modern profile (TLS 1.3 only).
- HTTP/1.1 and HTTP/2 to visitors; HTTP/2 or h2c to the origin. WebSocket, server-sent events (SSE) and gRPC go through the proxy.
- OCSP stapling, HSTS, and mutual TLS: visitors' client certificates, and a certificate presented to the origin.
- An alert warns 14 days before a certificate expires.
What is not done, or not proven
We prefer to say it plainly.
- HTTP/3 (QUIC) is not offered, nor is post-quantum key exchange or ECH.
- Orders with real authorities and DNS providers have not yet been tried in real conditions: order the first certificate for a site that can wait, and read the task log.
- ToutWAF does not manage your DNS and creates no record: it tells you which ones to create.
- Certificates are public by design: the names they contain are visible to everyone, whatever the tool.
Use cases
Put a new site on HTTPS
DNS is checked, the certificate is ordered when everything is green, then the redirect to HTTPS turns on.
Protect *.example.com
A wildcard certificate through DNS-01, with a DNS webhook or in manual mode.
An existing enterprise certificate
You import your internal authority's certificate; it is reloaded on the fly when you replace it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionKostenlos In allen Angeboten enthalten, auch in den beiden kostenlosen (Free und Free +)Pro und höher Kostenpflichtige Angebote: in der Konsole sichtbar, ohne Lizenz gesperrt. Ab Pro, sofern nicht Agency oder Enterprise angegeben ist
Noch nicht unter realen Bedingungen erprobt Funktioniert in den Tests des Produkts, wurde aber noch nicht mit dem echten Dienst, System oder Gerät erprobt. Die Konsole zeigt denselben Hinweis dort, wo Sie die Funktion einrichten.
- TLS 1.2 und 1.3 (Intermediate-Profil) oder nur TLS 1.3 (Modern-Profil)Kostenlos
- HTTP/1.1 und HTTP/2 zu den Besuchern, HTTP/2 oder h2c zum Origin (HTTP/3 ist nicht verfügbar)Kostenlos
- Automatische Zertifikate von einer Zertifizierungsstelle Ihrer Wahl: Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com Noch nicht unter realen Bedingungen erprobtKostenlos
- HTTP-01- und DNS-01-Challenges, Erneuerung 30 Tage vor AblaufKostenlos
- Prüfungen vor einer Bestellung: A- und AAAA-Einträge, CDN-Erkennung, Erreichbarkeit von Port 80Kostenlos
- Eigene Zertifikate, neu geladen ohne einen Handshake abzubrechenKostenlos
- OCSP-Stapling und HSTSKostenlos
- Gegenseitiges TLS: Client-Zertifikate der Besucher und zum OriginKostenlos
- WebSocket-, Server-Sent-Events- und gRPC-ProxyKostenlos
- Mehrere Zertifizierungsstellen mit automatischer Umschaltung, kostenpflichtige und interne ACME-Verzeichnisse Noch nicht unter realen Bedingungen erprobtPro und höher
Zum Standardwert einer erweiterten Option zurückzukehren ist immer möglich. Was am Ende einer kostenpflichtigen Lizenz geschieht, steht in den FAQ zu den Preisen: 48 Stunden Karenzzeit, 48 Stunden Nur-Lesen, danach WAF-Schutz aus bis zur Verlängerung.
Stellen Sie noch heute einen Schild vor Ihre Anwendungen
Installieren Sie es auf Ihrem eigenen Server oder schreiben Sie uns, um über Lizenzen zu sprechen.