SSL Certificate

DeepFilter's management panel and end user portal are published over HTTPS only. The installation starts with a self-signed certificate so that the service can run encrypted from the very first minute. This page explains why that temporary certificate produces a browser warning, and how to switch to a Let's Encrypt certificate from the panel.

After installation: the self-signed certificate

When installation completes, the server uses a certificate it generated itself. This certificate encrypts traffic, but it is not signed by any public certificate authority. Because the browser cannot validate it, it shows a warning such as "Your connection is not private" or "It is not safe to proceed to this site".

The warning is not a sign of a fault. You can dismiss it and continue in order to reach the initial setup wizard and the panel. For permanent use, however, switching to a trusted certificate is recommended; otherwise every administrator and portal user will run into this warning.

caution

Do not announce the portal address to end users while a self-signed certificate is in use. Once users treat a certificate warning as normal, it becomes harder for them to notice a genuine certificate problem later on.

Obtaining a Let's Encrypt certificate

There are two ways to move to a trusted certificate: if you already hold a certificate issued by a certificate authority (a commercial CA or your organisation's own PKI), you can upload it directly from the panel (see Administration → General Settings); if you do not have such a certificate, you can obtain a free one through Let's Encrypt from the panel. This page covers the Let's Encrypt flow, which is the most common route for a first installation.

Let's Encrypt offers two validation methods, and the method is selected manually in the panel — the system does not inspect your environment and pick one automatically.

The common prerequisite for both methods is that the domain name you are obtaining the certificate for (for example mail.alanadi.com) is defined in DNS and points to this server. For the domain records, see the DNS Records section on the Network Requirements page.

HTTP-01 method

To verify that the domain belongs to you, Let's Encrypt connects to your server on port 80/tcp and reads the validation file.

Requirements:

Requirement	Description
Port 80/tcp open	The server must be reachable from the internet; the firewall and any upstream filters must allow it
A record for the domain	The name the certificate is issued for must point directly at this server's public IP
Port forwarding if behind NAT	Port 80 on the external IP must be forwarded to the server

Steps:

1. Open the SSL certificate screen in the panel.
2. Select HTTP-01 as the method.
3. Enter the domain name the certificate will be issued for.
4. Enter the administrator's email address as the notification address.
5. Start the process and wait for validation to finish.

When validation completes, the certificate status card shows Let's Encrypt as the provider along with the new validity date; when you refresh the panel, the browser no longer shows a security warning. That is the sign that the certificate has been issued.

note

Port 80 is used only for certificate validation and for the redirect to HTTPS. The management panel is published on port 9443 and the end user portal on port 9445; port 443 is not open.

DNS-01 method

With this method, validation is not performed by connecting to the server but by writing a temporary TXT record into your domain's DNS zone. The server does not need to be reachable from the internet.

caution

The DNS-01 method is supported only for DNS zones hosted on Cloudflare. If your domain's DNS is not managed on Cloudflare, use the HTTP-01 method.

Steps:

1. In your Cloudflare account, create an API key with permission to edit DNS records in the relevant zone.
2. On the SSL certificate screen in the panel, select DNS-01 as the method.
3. Enter the domain name and the Cloudflare API details.
4. Enter the administrator's email address as the notification address.
5. Start the process; the TXT record is written automatically and removed once validation is done.

When validation completes, the certificate status card shows Let's Encrypt as the provider along with the new validity date; when you refresh the panel, the browser no longer shows a security warning.

Which method should I choose

Situation	Recommended method
The server has a public IP and port 80 can be opened to the outside	HTTP-01
Port 80 cannot be opened because of corporate policy	DNS-01 (if DNS is on Cloudflare)
The server is behind NAT and port forwarding is not possible	DNS-01 (if DNS is on Cloudflare)
DNS is not on Cloudflare	HTTP-01

In short: if you can open port 80 even temporarily, HTTP-01 is the simplest route. If you cannot and your DNS is on Cloudflare, switch to DNS-01.

Automatic renewal

Once the certificate has been issued, renewal is automatic; the system refreshes the certificate itself before it expires. No manual action is required.

If renewal fails, an email is sent to the notification address you entered when the certificate was issued. When you receive this alert, check the following:

1. Whether the domain's A record still points at this server.
2. Whether port 80 is still open to the outside, if you are using HTTP-01.
3. Whether the Cloudflare API details are still valid, if you are using DNS-01 (the key may have been revoked or expired).
4. Whether the server's internet access and DNS resolution are working.

danger

For the notification email, use an administrator address that is reachable from outside rather than one on a domain DeepFilter itself filters. If a certificate problem turns into a delivery problem, you must be able to read the alert from outside your own system.

Once the renewal problem is resolved, you can return to a normal state by obtaining the certificate again from the panel.