WBSP
ProvidersWikiSign in
All pages

Custom Domains

Every application deployed to an aws destination gets trusted HTTPS automatically. You never buy certificates, generate keys, or configure TLS.

  • On the platform's own domain (<app>.<platform domain>), nothing at all is needed: the platform's wildcard certificate already covers it.
  • On a domain of your own (myapp.example.com), follow the steps below. The platform then gets a Let's Encrypt certificate for it, redirects HTTP to HTTPS, and renews the certificate before it expires.

Setting up a custom domain

  1. Point the domain at the platform with a CNAME record. Your platform operator gives you the address to point at:

    myapp.example.com  CNAME  <the platform's address for custom domains>

  2. Name the domain in your wbsp.yaml, against the destination that should serve it:

    destination:
  prod:
    type: aws
    tenant: acme
    cluster: main
    enclave: myapp
access: public
routes:
  prod: { domain: myapp.example.com }

  3. Deploy:

    wbsp deploy --destination prod --config wbsp.yaml

The site serves HTTPS within a minute or two.

More than one domain

The routes map has one entry per destination. To serve the same application on a second domain, declare a second aws destination with its own route. Each is an independent placement, and each domain gets its own certificate:

destination:
  prod:
    type: aws
    tenant: acme
    cluster: main
    enclave: myapp
  prod-alt:
    type: aws
    tenant: acme
    cluster: main
    enclave: myapp-alt
access: public
routes:
  prod:     { domain: myapp.example.com }
  prod-alt: { domain: myapp.customdomain.org }

What to expect

  • First visit: the very first HTTPS request may take up to a minute while the certificate is issued.
  • HTTP: every HTTP request is redirected to HTTPS.
  • Renewal: automatic, about 30 days before expiry.
  • Removal: when you remove the application or change its domain, the old route goes and its certificate is no longer renewed.

Troubleshooting

No certificate after deploying?

  • Check that the CNAME has propagated: dig myapp.example.com CNAME.
  • The CNAME must resolve to the platform before a certificate can be issued. If it hasn't propagated yet, the platform retries automatically.

The browser says "Not Secure"?

  • The platform may still be using practice certificates, which browsers don't trust. Ask your platform operator.

Operators: how certificates work underneath is described in Certificates.