Your First SSL Certificate

HEIMWALL obtains and renews your certificate automatically once DNS routing is verified; in most cases you don’t need to do anything. The certificate is issued over the ACME protocol via Let’s Encrypt or ZeroSSL as a dual ECDSA + RSA certificate, and wildcards are supported.

Check the certificate status

1. Open Console → WAF → [domain] → Certificates.

2. The Current Certificate card shows the certificate’s Common Name (CN), issuer, validity range, days remaining and a status badge (Valid / Invalid); with dual certificates the ECDSA expiry is shown separately.

3. If the first certificate hasn’t been issued yet, make sure DNS verification is complete (the “Routing verified” badge on the Addresses page). Issuance starts after verification and usually completes within a few minutes — at most about 6 minutes.

HTTPS redirect turns on automatically

When the first certificate is issued, the Redirect to HTTPS (HTTP → HTTPS) setting is enabled automatically; your site moves to HTTPS without interruption.

SSL/TLS settings

The toggles on Console → WAF → [domain] → SSL / TLS:

• Automatic SSL — automatic certificate issuance and renewal via ACME. We recommend leaving it on.
• HTTPS Enabled — TLS on port 443. Don’t turn this off in production.
• Redirect to HTTPS — moves HTTP requests to HTTPS.
• Minimum TLS version — choose between TLS 1.0–1.3.
• OCSP Stapling — speeds up certificate revocation checks.

Certificate managed by Automatic SSL

While Automatic SSL is on, the certificate authority, issuance and renewal are handled entirely by HEIMWALL — the Certificates page is view-only in this state and there is nothing for you to do. Certificates are obtained via ACME and renewed automatically before they expire.

Upload your own certificate

If you want to use a corporate or EV certificate:

1. First turn off Automatic SSL on Console → WAF → [domain] → SSL / TLS. If it stays on, automatic renewal will overwrite the certificate you upload.

2. In the upload section of the Certificates page, paste the X.509 certificate block (with intermediates if any) into the Certificate (PEM) field and your key into the Private Key (PEM) field, or pick files.

3. Optional: use Also upload an ECDSA certificate (dual certificate) to add a second ECDSA pair — modern browsers get ECDSA, older clients get RSA.

4. Save with Verify and Upload. Before saving, the key-certificate match, validity period and domain coverage are verified. The private key is stored encrypted and can never be viewed.

Certificate not issuing?

The most common cause is DNS not yet pointing at HEIMWALL — ACME validation requires traffic to flow through the edge. Complete the DNS Setup and Verification steps first. For detailed troubleshooting, see SSL Troubleshooting.

Next step

Creating Your First WAF RuleWrite your first custom security rule with the visual rule builder.