A certificate without thinking about it
ToutWAF orders a site's certificate, installs it on your nodes without interrupting a handshake and renews it 30 days before it expires.
Certificates and TLS
Certificates ordered and renewed automatically from the authority of your choice, modern TLS, HTTP/2 and your own certificates. ToutWAF checks your DNS before ordering, so your attempts are not wasted.
Where to find it in the console : Infrastructure menu: Certificates (the « Sites without a certificate » block and the ACME settings); the go-live assistant and ToutWAF Doctor.
What it is for
Orders that do not fail for nothing
Before contacting the authority, ToutWAF checks the node, port 80 and your A and AAAA records. An order that is bound to fail is not sent.
The authority of your choice
Let's Encrypt, ZeroSSL, Google Trust Services or SSL.com. With a licence: fallback authorities and any ACME directory, paid or internal.
Your certificates and modern TLS
Import your own, choose TLS 1.2 and 1.3 or 1.3 only, OCSP stapling, HSTS, mutual TLS and HTTP/2.
From domain name to installed certificate
The control plane orders and stores the certificate; the nodes fetch it regularly and load it on the fly.
Checks before the order
A node is enrolled and online, a policy is published, port 80 listens, and every A and AAAA record of the name leads to this ToutWAF.
HTTP-01 or DNS-01 challenge
HTTP-01 proves the name leads here through port 80. DNS-01 is for wildcards (*.example.com) and when your provider blocks port 80.
Hot installation and renewal
Nodes fetch certificates every 60 seconds. The server name picks the right certificate through SNI, with no restart.
The classic trap: IPv6 and CDN
Browsers and authorities try IPv6 first. An AAAA record left at a CDN makes the order fail with an error that never mentions DNS. ToutWAF looks at both address families.
- A name that does not resolve, a record that points elsewhere or a private address: the check says so and proposes what to do.
- An AAAA record that belongs to a proxy while the A record points here is recognised (Cloudflare for example): delete the AAAA or turn the proxy off for the order, or use DNS-01.
- The optional test from the Internet has the Let's Encrypt test server try your site, without keeping a certificate.
- Nothing about your visitors or the content of your pages is sent.
Choose the certificate authority
GratuitoPro e superiores
One public authority of your choice is free. Fallback options and paid or internal directories require a licence.
- Free: Let's Encrypt (default), ZeroSSL, Google Trust Services or SSL.com. The last three need an account key (EAB) that you create with them.
- Licence required: up to three fallback authorities, tried in order when the first cannot issue (rate limit, outage, refused account, CAA record).
- Licence required: another ACME directory, paid (Sectigo, DigiCert...) or internal (step-ca, Vault PKI).
- ToutWAF reads the CAA records of the domain and skips the authorities it does not name. A validation that fails does not switch authority.
Ainda não testada em condições reaisThe directories of the four authorities were read live, but ordering, switching authority and the CAA check were tried against a simulated ACME server.
DNS-01 and wildcard certificates
ToutWAF does not manage your DNS zone: it tells you what to create and checks it.
- With a DNS webhook, the control plane sends it the TXT record to put in place and then remove.
- Without a webhook, manual mode shows the TXT record to create and waits for it to appear, up to ten minutes.
- On a standalone node, DNS-01 can also call Cloudflare, OVH or Route 53, or run your command.
- Try the authority's test environment first to avoid its rate limits.
Ainda não testada em condições reaisThe DNS providers were not tried with real calls.
Your own certificates
Gratuito
Import a certificate and its key in PEM format, or drop the files in the intended folder.
- Certificates are reloaded without a restart or interrupted handshake; the choice is made through SNI from the certificate names.
- Private keys are never returned by the API.
- Before the first certificate, a site is served over plain HTTP; it is redirected to HTTPS only once a real certificate is installed.
TLS and protocols
Gratuito
Sober settings, with reasonable defaults.
- Intermediate profile (TLS 1.2 and 1.3) or modern profile (TLS 1.3 only).
- HTTP/1.1 and HTTP/2 to visitors; HTTP/2 or h2c to the origin. WebSocket, server-sent events (SSE) and gRPC go through the proxy.
- OCSP stapling, HSTS, and mutual TLS: visitors' client certificates, and a certificate presented to the origin.
- An alert warns 14 days before a certificate expires.
What is not done, or not proven
We prefer to say it plainly.
- HTTP/3 (QUIC) is not offered, nor is post-quantum key exchange or ECH.
- Orders with real authorities and DNS providers have not yet been tried in real conditions: order the first certificate for a site that can wait, and read the task log.
- ToutWAF does not manage your DNS and creates no record: it tells you which ones to create.
- Certificates are public by design: the names they contain are visible to everyone, whatever the tool.
Use cases
Put a new site on HTTPS
DNS is checked, the certificate is ordered when everything is green, then the redirect to HTTPS turns on.
Protect *.example.com
A wildcard certificate through DNS-01, with a DNS webhook or in manual mode.
An existing enterprise certificate
You import your internal authority's certificate; it is reloaded on the fly when you replace it.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Ainda não testada em condições reais Funciona nos testes do produto, mas ainda não foi testada com o serviço, o sistema ou o equipamento reais. A consola mostra a mesma nota onde configura a função.
- TLS 1.2 e 1.3 (perfil intermédio) ou só TLS 1.3 (perfil moderno)Gratuito
- HTTP/1.1 e HTTP/2 para os visitantes, HTTP/2 ou h2c para a origem (HTTP/3 não está disponível)Gratuito
- Certificados automáticos de uma autoridade à sua escolha: Let's Encrypt, ZeroSSL, Google Trust Services, SSL.com Ainda não testada em condições reaisGratuito
- Desafios HTTP-01 e DNS-01, renovação 30 dias antes da expiraçãoGratuito
- Verificações antes de uma encomenda: registos A e AAAA, deteção de CDN, acessibilidade da porta 80Gratuito
- Os seus próprios certificados, recarregados sem interromper nenhum handshakeGratuito
- OCSP stapling e HSTSGratuito
- TLS mútuo: certificados de cliente dos visitantes e para a origemGratuito
- Proxy de WebSocket, eventos enviados pelo servidor (SSE) e gRPCGratuito
- Várias autoridades com comutação automática, diretórios ACME pagos ou internos Ainda não testada em condições reaisPro e superiores
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.