SSL Certificate
DeepFilter's management panel and end user portal are published over HTTPS only. The installation starts with a self-signed certificate so that the service can run encrypted from the very first minute. This page explains why that temporary certificate produces a browser warning, and how to switch to a Let's Encrypt certificate from the panel.
After installation: the self-signed certificate
When installation completes, the server uses a certificate it generated itself. This certificate encrypts traffic, but it is not signed by any public certificate authority. Because the browser cannot validate it, it shows a warning such as "Your connection is not private" or "It is not safe to proceed to this site".
The warning is not a sign of a fault. You can dismiss it and continue in order to reach the initial setup wizard and the panel. For permanent use, however, switching to a trusted certificate is recommended; otherwise every administrator and portal user will run into this warning.
Do not announce the portal address to end users while a self-signed certificate is in use. Once users treat a certificate warning as normal, it becomes harder for them to notice a genuine certificate problem later on.
Obtaining a Let's Encrypt certificate
There are two ways to move to a trusted certificate: if you already hold a certificate issued by a certificate authority (a commercial CA or your organisation's own PKI), you can upload it directly from the panel (see Administration → General Settings); if you do not have such a certificate, you can obtain a free one through Let's Encrypt from the panel. This page covers the Let's Encrypt flow, which is the most common route for a first installation.
Let's Encrypt offers two validation methods, and the method is selected manually in the panel — the system does not inspect your environment and pick one automatically.
The common prerequisite for both methods is that the domain name you are obtaining the certificate for (for example mail.alanadi.com) is defined in DNS and points to this server. For the domain records, see the DNS Records section on the Network Requirements page.
HTTP-01 method
To verify that the domain belongs to you, Let's Encrypt connects to your server on port 80/tcp and reads the validation file.
Requirements:
| Requirement | Description |
|---|---|
| Port 80/tcp open | The server must be reachable from the internet; the firewall and any upstream filters must allow it. It must stay open not only for the first issuance but for every automatic renewal as well |
| A record for the domain | The name the certificate is issued for must point directly at this server's public IP |
| Port forwarding if behind NAT | Port 80 on the external IP must be forwarded to the server |
Steps:
- On the Management → General Settings screen, find the SSL Certificate card and click Let's Encrypt.
- Select HTTP (Port 80) as the Validation Method.
- Click Start Let's Encrypt and wait for validation to finish.
The certificate is issued for the fully qualified domain name defined in the SMTP Hostname field under General Settings; if that field is empty, fill it in first (see General Settings).
When validation completes, the certificate status card shows Let's Encrypt as the provider along with the new validity date; when you refresh the panel, the browser no longer shows a security warning. That is the sign that the certificate has been issued.
Port 80 is used only for certificate validation and for the redirect to HTTPS. The management panel is published on port 9443 and the end user portal on port 9445; port 443 is not open.
DNS-01 method
With this method, validation is not performed by connecting to the server but by writing a temporary TXT record into your domain's DNS zone. The server does not need to be reachable from the internet. Automatic renewal is also performed the same way, over DNS; port 80 therefore does not need to be open to the outside.
The DNS-01 method is supported only for DNS zones hosted on Cloudflare. If your domain's DNS is not managed on Cloudflare, use the HTTP-01 method.
Steps:
- On the Management → General Settings screen, find the SSL Certificate card, click Let's Encrypt and select Cloudflare DNS as the Validation Method.
- Use the Open Token Creation Page button to create an API token in Cloudflare with permission to edit DNS records in the relevant zone.
- Paste the token into the field and click Verify and Save.
- Click Get Certificate; the TXT record is written automatically and removed once validation is done.
When validation completes, the certificate status card shows Let's Encrypt as the provider along with the new validity date; when you refresh the panel, the browser no longer shows a security warning.
Which method should I choose
| Situation | Recommended method |
|---|---|
| The server has a public IP and port 80 can be kept permanently open to the outside | HTTP-01 |
| Port 80 cannot be opened because of corporate policy | DNS-01 (if DNS is on Cloudflare) |
| The server is behind NAT and port forwarding is not possible | DNS-01 (if DNS is on Cloudflare) |
| DNS is not on Cloudflare | HTTP-01 |
In short: if you can keep port 80 permanently open to the outside, HTTP-01 is the simplest route. Because renewal also goes through this port, the certificate cannot be renewed if the port is opened only for the first issuance and closed afterwards. If you cannot keep port 80 open and your DNS is on Cloudflare, switch to DNS-01.
Automatic renewal
Once the certificate has been issued, renewal is automatic; about 30 days before expiry the system refreshes the certificate itself. No manual action is required.
Renewal uses the validation method you selected in the panel: over port 80 if HTTP (Port 80) is selected, over DNS if Cloudflare DNS is selected. Every fifteen minutes the system checks whether the renewal setting matches the selection in the panel. If it differs (for example because you changed the method later), the system switches the renewal setting to the method you selected and, if the certificate is due for renewal, renews it right away.
The same check is also made at the moment you obtain the certificate from the panel. If the renewal setting cannot be switched to the method you selected, the panel shows this as an error even though the certificate has been obtained and distributed to the services. In that case, fix the problem stated in the error and repeat the operation; otherwise renewal is attempted with the old method and may fail.
When the certificate is obtained or renewed, the new certificate is distributed to all services and the email service restarts briefly. This takes a few seconds: SMTP connections open at that moment may drop and the sending servers retry delivery; the emails in the queue are preserved.
If automatic renewal fails, the system reports it by email. If fewer than 25 days remain until the Let's Encrypt certificate expires and it has still not been renewed, a single SSL Renewal Failed alert is sent to the administrator; the same alert also arrives when the background check cannot switch the renewal setting to the method you selected. If the certificate expires, an SSL Certificate Expired alert is sent as well. No advance warning is sent because the expiry date is approaching. Alerts go to the Admin Alert Emails addresses on the Management → Notifications screen (see Notifications); no email address is used for the Let's Encrypt registration.
When you receive the alert, check the following:
- Whether the domain's A record still points at this server.
- If the HTTP (Port 80) method is selected, whether port 80 is open to the outside and, if the server is behind NAT, forwarded to this server.
- If the Cloudflare DNS method is selected, whether the API token is still valid (the token may have been revoked, expired, or lost its permission on the domain's zone).
- Whether the server's internet access and DNS resolution are working.
For the Admin Alert Emails, use an administrator address that is reachable from outside rather than one on a domain DeepFilter itself filters. If a certificate problem turns into a delivery problem, you must be able to read the alert from outside your own system.
Once the renewal problem is resolved, you can return to a normal state by obtaining the certificate again from the panel.