A certificate without thinking about it
ToutWAF orders a site's certificate, installs it on your nodes without interrupting a handshake and renews it 30 days before it expires.
Certificates and TLS
Certificates ordered and renewed automatically from the authority of your choice, modern TLS, HTTP/2 and your own certificates. ToutWAF checks your DNS before ordering, so your attempts are not wasted.
Where to find it in the console : Infrastructure menu: Certificates (the « Sites without a certificate » block and the ACME settings); the go-live assistant and ToutWAF Doctor.
What it is for
Orders that do not fail for nothing
Before contacting the authority, ToutWAF checks the node, port 80 and your A and AAAA records. An order that is bound to fail is not sent.
The authority of your choice
Let's Encrypt, ZeroSSL, Google Trust Services or SSL.com. With a licence: fallback authorities and any ACME directory, paid or internal.
Your certificates and modern TLS
Import your own, choose TLS 1.2 and 1.3 or 1.3 only, OCSP stapling, HSTS, mutual TLS and HTTP/2.
From domain name to installed certificate
The control plane orders and stores the certificate; the nodes fetch it regularly and load it on the fly.
Checks before the order
A node is enrolled and online, a policy is published, port 80 listens, and every A and AAAA record of the name leads to this ToutWAF.
HTTP-01 or DNS-01 challenge
HTTP-01 proves the name leads here through port 80. DNS-01 is for wildcards (*.example.com) and when your provider blocks port 80.
Hot installation and renewal
Nodes fetch certificates every 60 seconds. The server name picks the right certificate through SNI, with no restart.
The classic trap: IPv6 and CDN
Browsers and authorities try IPv6 first. An AAAA record left at a CDN makes the order fail with an error that never mentions DNS. ToutWAF looks at both address families.
- A name that does not resolve, a record that points elsewhere or a private address: the check says so and proposes what to do.
- An AAAA record that belongs to a proxy while the A record points here is recognised (Cloudflare for example): delete the AAAA or turn the proxy off for the order, or use DNS-01.
- The optional test from the Internet has the Let's Encrypt test server try your site, without keeping a certificate.
- Nothing about your visitors or the content of your pages is sent.
Choose the certificate authority
FreePro and above
One public authority of your choice is free. Fallback options and paid or internal directories require a licence.
- Free: Let's Encrypt (default), ZeroSSL, Google Trust Services or SSL.com. The last three need an account key (EAB) that you create with them.
- Licence required: up to three fallback authorities, tried in order when the first cannot issue (rate limit, outage, refused account, CAA record).
- Licence required: another ACME directory, paid (Sectigo, DigiCert...) or internal (step-ca, Vault PKI).
- ToutWAF reads the CAA records of the domain and skips the authorities it does not name. A validation that fails does not switch authority.
Not yet tried in real conditionsThe directories of the four authorities were read live, but ordering, switching authority and the CAA check were tried against a simulated ACME server.
DNS-01 and wildcard certificates
ToutWAF does not manage your DNS zone: it tells you what to create and checks it.
- With a DNS webhook, the control plane sends it the TXT record to put in place and then remove.
- Without a webhook, manual mode shows the TXT record to create and waits for it to appear, up to ten minutes.
- On a standalone node, DNS-01 can also call Cloudflare, OVH or Route 53, or run your command.
- Try the authority's test environment first to avoid its rate limits.
Not yet tried in real conditionsThe DNS providers were not tried with real calls.
Your own certificates
Free
Import a certificate and its key in PEM format, or drop the files in the intended folder.
- Certificates are reloaded without a restart or interrupted handshake; the choice is made through SNI from the certificate names.
- Private keys are never returned by the API.
- Before the first certificate, a site is served over plain HTTP; it is redirected to HTTPS only once a real certificate is installed.
TLS and protocols
Free
Sober settings, with reasonable defaults.
- Intermediate profile (TLS 1.2 and 1.3) or modern profile (TLS 1.3 only).
- HTTP/1.1 and HTTP/2 to visitors; HTTP/2 or h2c to the origin. WebSocket, server-sent events (SSE) and gRPC go through the proxy.
- OCSP stapling, HSTS, and mutual TLS: visitors' client certificates, and a certificate presented to the origin.
- An alert warns 14 days before a certificate expires.
What is not done, or not proven
We prefer to say it plainly.
- HTTP/3 (QUIC) is not offered, nor is post-quantum key exchange or ECH.
- Orders with real authorities and DNS providers have not yet been tried in real conditions: order the first certificate for a site that can wait, and read the task log.
- ToutWAF does not manage your DNS and creates no record: it tells you which ones to create.
- Certificates are public by design: the names they contain are visible to everyone, whatever the tool.
Use cases
Put a new site on HTTPS
DNS is checked, the certificate is ordered when everything is green, then the redirect to HTTPS turns on.
Protect *.example.com
A wildcard certificate through DNS-01, with a DNS webhook or in manual mode.
An existing enterprise certificate
You import your internal authority's certificate; it is reloaded on the fly when you replace it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Not yet tried in real conditions Works in the product's tests, but has not yet been tried with the real service, system or equipment. The console shows the same note where you set the function up.
- TLS 1.2 and 1.3 (intermediate profile) or TLS 1.3 only (modern profile)Free
- HTTP/1.1 and HTTP/2 to visitors, HTTP/2 or h2c to the origin (HTTP/3 is not available)Free
- Automatic certificates from one authority of your choice: Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com Not yet tried in real conditionsFree
- HTTP-01 and DNS-01 challenges, renewal 30 days before expiryFree
- Checks before an order: A and AAAA records, CDN detection, reachability of port 80Free
- Your own certificates, reloaded without dropping a handshakeFree
- OCSP stapling and HSTSFree
- Mutual TLS: client certificates from visitors, and towards the originFree
- WebSocket, server-sent events and gRPC proxyingFree
- Several authorities with automatic failover, paid and internal ACME directories Not yet tried in real conditionsPro and above
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.