SSL & TLS Certificate Management

HEIMWALL automatically provisions and renews SSL/TLS certificates for every WAF-enabled domain. No action is required by default.

---

SSL / TLS settings

Console → WAF → [your domain] → SSL / TLS has three toggles:

Toggle	What it does
HTTPS Enabled	The domain listens on port 443 with TLS. When off, only port 80 (HTTP) is open; turning this off in production is not recommended.
Automatic SSL (ACME)	Certificates are issued and renewed automatically via Let’s Encrypt or ZeroSSL. The first time you enable it, you will be asked to accept the automation agreement.
Redirect to HTTPS	HTTP requests are redirected to HTTPS with a 301 response. Unavailable when HTTPS Enabled is off.

Certificate Status card

The Certificate Status card below the toggles shows:

• The current certificate’s issuer (Let’s Encrypt, ZeroSSL, or Manual), expiry date and days remaining
• The result of the last renewal attempt; the error reason if it failed
• Active key types (ECDSA, RSA, or both)
• A retry button — enabled once the rate-limit cooldown has passed

---

Automatic renewal

When Automatic SSL is on, HEIMWALL renews the certificate before it expires. If a renewal fails, the error reason appears in the Certificate Status card and the Retry button becomes available once the cooldown expires.

---

Dual ECDSA + RSA certificates

HEIMWALL maintains two certificates for the same domain simultaneously:

• ECDSA P-256 — served to modern clients (Chrome, Firefox, Safari, mobile) — smaller and faster
• RSA — served to legacy or specialised clients that do not support ECDSA

Certificate selection happens automatically during the TLS handshake; no configuration is needed.

---

Post-quantum TLS

On supporting clients, HEIMWALL uses the X25519MLKEM768 hybrid key exchange over TLS 1.3. This pairs the classical X25519 elliptic-curve exchange with ML-KEM (Kyber), standardised by NIST as a post-quantum algorithm.

Note

This is not a post-quantum certificate — it is the key exchange step during TLS session setup. Even before quantum computers capable of breaking current cryptography exist, connections are protected against future quantum attacks.

---

Upload your own certificate

Note

Custom certificate upload is a plan feature. If the upload form on the Certificates page is locked, your plan does not include it — contact support to upgrade.

Go to Console → WAF → [your domain] → Certificates to upload your own certificate.

Turn off Automatic SSL first. Manual upload is blocked while Automatic SSL is on — ACME protects the managed certificate. Disable Automatic SSL on the SSL/TLS page first, then go to the Certificates page.

Upload steps:

1. Paste the certificate chain into the Certificate (PEM) field (certificate + intermediates).
2. Paste the private key into the Private Key (PEM) field.
3. Optionally enable “Also upload ECDSA certificate” to add an ECDSA pair — if your provider issued an ECDSA version of the same order, you can set up dual-certificate serving.
4. Click Save.

The private key is never shown again after upload; it is stored encrypted.

If the certificate and key do not match, the certificate is expired, or the domain name is not covered, the system returns an error without saving.