A certificate without thinking about it
ToutWAF orders a site's certificate, installs it on your nodes without interrupting a handshake and renews it 30 days before it expires.
Certificates and TLS
Certificates ordered and renewed automatically from the authority of your choice, modern TLS, HTTP/2 and your own certificates. ToutWAF checks your DNS before ordering, so your attempts are not wasted.
Where to find it in the console : Infrastructure menu: Certificates (the « Sites without a certificate » block and the ACME settings); the go-live assistant and ToutWAF Doctor.
What it is for
Orders that do not fail for nothing
Before contacting the authority, ToutWAF checks the node, port 80 and your A and AAAA records. An order that is bound to fail is not sent.
The authority of your choice
Let's Encrypt, ZeroSSL, Google Trust Services or SSL.com. With a licence: fallback authorities and any ACME directory, paid or internal.
Your certificates and modern TLS
Import your own, choose TLS 1.2 and 1.3 or 1.3 only, OCSP stapling, HSTS, mutual TLS and HTTP/2.
From domain name to installed certificate
The control plane orders and stores the certificate; the nodes fetch it regularly and load it on the fly.
Checks before the order
A node is enrolled and online, a policy is published, port 80 listens, and every A and AAAA record of the name leads to this ToutWAF.
HTTP-01 or DNS-01 challenge
HTTP-01 proves the name leads here through port 80. DNS-01 is for wildcards (*.example.com) and when your provider blocks port 80.
Hot installation and renewal
Nodes fetch certificates every 60 seconds. The server name picks the right certificate through SNI, with no restart.
The classic trap: IPv6 and CDN
Browsers and authorities try IPv6 first. An AAAA record left at a CDN makes the order fail with an error that never mentions DNS. ToutWAF looks at both address families.
- A name that does not resolve, a record that points elsewhere or a private address: the check says so and proposes what to do.
- An AAAA record that belongs to a proxy while the A record points here is recognised (Cloudflare for example): delete the AAAA or turn the proxy off for the order, or use DNS-01.
- The optional test from the Internet has the Let's Encrypt test server try your site, without keeping a certificate.
- Nothing about your visitors or the content of your pages is sent.
Choose the certificate authority
GratisPro en hoger
One public authority of your choice is free. Fallback options and paid or internal directories require a licence.
- Free: Let's Encrypt (default), ZeroSSL, Google Trust Services or SSL.com. The last three need an account key (EAB) that you create with them.
- Licence required: up to three fallback authorities, tried in order when the first cannot issue (rate limit, outage, refused account, CAA record).
- Licence required: another ACME directory, paid (Sectigo, DigiCert...) or internal (step-ca, Vault PKI).
- ToutWAF reads the CAA records of the domain and skips the authorities it does not name. A validation that fails does not switch authority.
Nog niet onder echte omstandigheden getestThe directories of the four authorities were read live, but ordering, switching authority and the CAA check were tried against a simulated ACME server.
DNS-01 and wildcard certificates
ToutWAF does not manage your DNS zone: it tells you what to create and checks it.
- With a DNS webhook, the control plane sends it the TXT record to put in place and then remove.
- Without a webhook, manual mode shows the TXT record to create and waits for it to appear, up to ten minutes.
- On a standalone node, DNS-01 can also call Cloudflare, OVH or Route 53, or run your command.
- Try the authority's test environment first to avoid its rate limits.
Nog niet onder echte omstandigheden getestThe DNS providers were not tried with real calls.
Your own certificates
Gratis
Import a certificate and its key in PEM format, or drop the files in the intended folder.
- Certificates are reloaded without a restart or interrupted handshake; the choice is made through SNI from the certificate names.
- Private keys are never returned by the API.
- Before the first certificate, a site is served over plain HTTP; it is redirected to HTTPS only once a real certificate is installed.
TLS and protocols
Gratis
Sober settings, with reasonable defaults.
- Intermediate profile (TLS 1.2 and 1.3) or modern profile (TLS 1.3 only).
- HTTP/1.1 and HTTP/2 to visitors; HTTP/2 or h2c to the origin. WebSocket, server-sent events (SSE) and gRPC go through the proxy.
- OCSP stapling, HSTS, and mutual TLS: visitors' client certificates, and a certificate presented to the origin.
- An alert warns 14 days before a certificate expires.
What is not done, or not proven
We prefer to say it plainly.
- HTTP/3 (QUIC) is not offered, nor is post-quantum key exchange or ECH.
- Orders with real authorities and DNS providers have not yet been tried in real conditions: order the first certificate for a site that can wait, and read the task log.
- ToutWAF does not manage your DNS and creates no record: it tells you which ones to create.
- Certificates are public by design: the names they contain are visible to everyone, whatever the tool.
Use cases
Put a new site on HTTPS
DNS is checked, the certificate is ordered when everything is green, then the redirect to HTTPS turns on.
Protect *.example.com
A wildcard certificate through DNS-01, with a DNS webhook or in manual mode.
An existing enterprise certificate
You import your internal authority's certificate; it is reloaded on the fly when you replace it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Nog niet onder echte omstandigheden getest Werkt in de tests van het product, maar is nog niet geprobeerd met de echte dienst, het echte systeem of de echte apparatuur. De console toont dezelfde opmerking waar u de functie instelt.
- TLS 1.2 en 1.3 (intermediair profiel) of alleen TLS 1.3 (modern profiel)Gratis
- HTTP/1.1 en HTTP/2 naar bezoekers, HTTP/2 of h2c naar de origin (HTTP/3 is niet beschikbaar)Gratis
- Automatische certificaten van één autoriteit naar keuze: Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com Nog niet onder echte omstandigheden getestGratis
- HTTP-01- en DNS-01-challenges, verlenging 30 dagen voor het verlopenGratis
- Controles vóór een bestelling: A- en AAAA-records, CDN-herkenning, bereikbaarheid van poort 80Gratis
- Uw eigen certificaten, herladen zonder een handshake te onderbrekenGratis
- OCSP-stapling en HSTSGratis
- Wederzijdse TLS: clientcertificaten van bezoekers en naar de originGratis
- Proxy voor WebSocket, server-sent events en gRPCGratis
- Meerdere autoriteiten met automatische failover, betaalde en interne ACME-directory's Nog niet onder echte omstandigheden getestPro en hoger
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.