Managing certificates

Pyo gets Let's Encrypt certificates for public domains automatically. You only need this page to use your own certificate.

Upload a certificateCopy Anchor Link

Open Certificates, in the sidebar's Domains menu, and upload a certificate with its private keyThe secret half of a certificate. Whoever holds it can use the certificate, so keep it safe.. One certificate can cover a single domain, or many with a wildcard like *.example.com.

The private key is stored encrypted on the server and is only sent to your team's clusters.

Use it on a domainCopy Anchor Link

Set a domain's HTTPS to your own certificate, then pick one that covers that hostname.

Replace or removeCopy Anchor Link

Replace a certificate before it expires, using the same page. Domains using it switch to the new one without a redeploy. Removing one deletes its private key from Pyo.

Mutual TLS (mTLS)Copy Anchor Link

If a CDNA network of servers, like Cloudflare, that sits between visitors and your servers to speed up and protect your sites. sits in front of your services, it can present a certificate to prove that a request came through it. This is called mTLS. Securing Pyo shows how to require it on your servers.

You can create a certificate when you turn on mTLS in a cluster's Settings tab. You can also create one ahead of time from Mutual TLS, in the sidebar's Domains menu. Give it a name, a common nameThe name written into the certificate to identify it. Any label you'll recognize works. and how long it's valid for. Team owners and admins can do this from the dashboard, but not with an API key.

You get a certificate and a private key to upload to your CDN. Pyo installs the matching CA certificateThe certificate that signed your CDN's certificate. Your clusters use it to check that a certificate is genuine. on your clusters for you.

If you lose the private key, create a new certificate and replace the old one.

Replace a certificateCopy Anchor Link

Pyo warns you in the activity feed 30 days and 7 days before a certificate expires. To replace one without downtime:

1. Create a new certificate.
2. In your cluster's Settings tab, choose Manage under mTLS and select both certificates, so your cluster accepts either.
3. Upload the new certificate and key to your CDN.
4. Choose Manage again and clear the old certificate.

You can't remove a certificate while a cluster requires it. Removing one only takes it off this page. Your CDN keeps presenting it until you change it there.

Turn mTLS off without the dashboardCopy Anchor Link

The dashboard isn't behind mTLS, so you can usually turn mTLS off there. If you've put the dashboard on a domain that mTLS blocks, run this on the server:

sudo k3s kubectl -n kube-system delete tlsoption default