Let's Encrypt Managed Certificates

OpenResty Edge can automatically obtain and renew TLS certificates from Let’s Encrypt. The following certificate types and any combination of them are supported:

• Single-domain certificates: e.g., example.com
• SAN (Subject Alternative Name) multi-domain certificates: e.g., a single certificate covering both example.com and www.example.com
• Wildcard certificates: e.g., *.example.com

# Prerequisites

Let’s Encrypt uses different validation methods for non-wildcard and wildcard domains. OpenResty Edge automatically detects which method to use for each domain during issuance, but you need to complete the corresponding configuration in advance.

# Non-wildcard domains (e.g., example.com, www.example.com)

HTTP validation is used. Let’s Encrypt will send an HTTP request to the domain, so you need to point the domain’s A record to the OpenResty Edge Node IP of the current Gateway Cluster at your DNS provider.

The DNS can be hosted anywhere, as long as the resolution result points to the OpenResty Edge Node.

If the A record does not point to the OpenResty Edge Node, but the authoritative DNS for the domain is already hosted on OpenResty Edge, the system will automatically fall back to DNS validation.

# Wildcard domains (e.g., *.example.com, *.a.example.com)

DNS validation is used (as required by Let’s Encrypt). Two configuration steps are needed:

1. Host a DNS application on OpenResty Edge

Host the parent domain (or a higher-level ancestor domain) of the wildcard domain as a DNS application in OpenResty Edge. For example:

2. Point NS records to OpenResty Edge at your domain registrar

At your domain registrar (e.g., GoDaddy, Namecheap, etc.), point the NS records for the corresponding domain to the OpenResty Edge Node, making OpenResty Edge the authoritative DNS server for that domain.

Changing the NS records means delegating the entire DNS resolution authority for that domain to OpenResty Edge. Make sure you have correctly configured all required DNS records in the OpenResty Edge DNS application.

You can refer to Migrating DNS Resolution to OpenResty Edge for more details.

# Issuing Certificates

Step 1: Click the “New Certificate” button, then select “Let’s Encrypt”.

Step 2: Enter one or more domain names, then click “Save”.

Step 3: OpenResty Edge will automatically complete domain validation, certificate request, and deployment. Refresh the page to check the issuance status.

# Automatic Renewal

OpenResty Edge automatically obtains or renews certificates in the following situations, with no manual intervention required:

1. When a new Let’s Encrypt certificate is added;
2. When the domain list of an existing Let’s Encrypt certificate is modified;
3. When the certificate has less than 30 days of validity remaining.

# Action Buttons

In the certificate list, the action buttons on the right side of each entry are, from left to right:

# Troubleshooting