# Domains and free SSL with Let's Encrypt for your site > Add domains and aliases, set www redirects, point DNS by hand or automatically with a DNS integration, and turn on HTTPS with a free Let's Encrypt certificate. The **Domains and SSL** page of a site manages the names your site answers to and the certificates it uses for HTTPS. A site has one primary domain, can have any number of aliases, and can also be reached on a free generated address on `on-deploy.link`. When a connected [integration](https://ops.vimonto.com/docs/connections/integrations) manages the domain's DNS, Vimonto Deploy can create the DNS records for you and request HTTPS by itself. For HTTPS, request a free Let's Encrypt certificate in a few clicks; it renews automatically. You can also install a certificate you bought, or create a certificate signing request for your certificate authority. ![The Domains and SSL page with the generated address, the site's domains and its certificates](https://ops.vimonto.com/docs-media/en/site-domains.webp?v=161e760d "A site's domains and certificates") ## The generated on-deploy.link address Every site can have an address such as `kalme-rivier-4821.on-deploy.link`. Vimonto Deploy creates its DNS record for you, so it works right away without any DNS of your own: handy for testing a site before it goes live, or for sharing a preview. The address is chosen when you [create the site](https://ops.vimonto.com/docs/sites/create-a-site#domain-or-generated-address). A site created on this address gets HTTPS by itself: as the last step of its setup, Vimonto Deploy waits until the new DNS record points to the server and then requests a Let's Encrypt certificate for it. A site created with a domain of its own skips this step. If you let a DNS integration point that domain, it gets HTTPS the same way once its records resolve (see [below](#point-your-domain-automatically-with-a-dns-integration)); otherwise request its certificate yourself once the DNS points to the server, as described below. On the Domains and SSL page, under **on-deploy.link address**, you can: - **Turn off** the address. The site is then only reachable on its own domains, and the DNS record is deleted. - **Turn on** an address again for a site that has none. A new address gets a different name. A site whose only name is the generated address cannot turn it off: add a domain of your own first, so the site always keeps at least one name. ## Add a domain 1. Click **Add domain**. 2. Type the **Domain**, for example `shop.example.com`. 3. Choose the **Wildcards** and **Redirects** options (see below). 4. Optionally switch on **Use as primary domain**. 5. Under **DNS**, choose how the domain gets its DNS records, if you have DNS integrations (see [below](#point-your-domain-automatically-with-a-dns-integration)). 6. Click **Add domain**. The first domain of your own becomes the primary domain, replacing the generated address (which keeps working alongside it). Later domains become aliases, unless you switch on **Use as primary domain**; the previous primary domain then stays as an alias. After you add a domain, Vimonto Deploy rewrites the site's Nginx configuration, checks it with `nginx -t` and reloads Nginx. If you manage the DNS yourself, the **Set up** dialog then opens with the DNS records to create. If a DNS integration points the domain, a task does that instead. ### Wildcards - **Off**: only the domain itself, such as `shop.example.com`. - **On**: all subdomains too, such as `blog.shop.example.com`. Nginx then also answers to `*.shop.example.com`. ### Redirects between www and the bare domain | Option | What happens | |---|---| | **Redirect from www.** (recommended) | `www.example.com` sends visitors to `example.com`. | | **Redirect to www.** | `example.com` sends visitors to `www.example.com`, which serves the site. | | **No redirect** | Only the domain itself; `www.` is not included. | Redirects are permanent (`301`) and keep the path and query string. You can change these options later with **Edit** in the domain's menu. ### Change the primary domain or remove a domain Each domain's menu has: - **Show setup steps**: the DNS records and HTTPS status of that domain. - **Edit**: change the wildcard and redirect options. - **Make primary**: make an alias the primary domain. - **Delete**: stop answering on the domain. When you remove the primary domain, the first alias takes over, or else the generated address. DNS records that Vimonto Deploy made for the domain at a connected account are removed with it, and the confirmation lists them; other records you remove at your DNS provider yourself. The primary domain is the one shown in the site header and used for the site's links. The site's directory on the server does not change when the primary domain does. ## Point your domain to the server with DNS > [!TIP] > Have a DNS integration? Then you skip this step: Vimonto Deploy creates the records for you. See [point your domain automatically](#point-your-domain-automatically-with-a-dns-integration). A domain only reaches your site once its DNS points to your server. Create the records at your DNS provider (where the domain is managed): | Type | Name | Value | When | |---|---|---|---| | A | `shop.example.com` | the server's IP address | always | | CNAME | `www.shop.example.com` | `shop.example.com` | with a www. redirect | | A | `*.shop.example.com` | the server's IP address | with wildcards on | The **Set up** dialog lists exactly these records for a domain, with **Points here** or **Not yet** for each, and you can click a name or value to copy it. Domains whose DNS does not point to the server yet are listed in a warning above the domains, and each domain row says **Points to this server** or where it points instead. DNS changes can take a few minutes to arrive. > [!NOTE] > Behind a proxy such as Cloudflare's, a domain resolves to the proxy, not to your server, so it shows as pointing elsewhere. The site can still work, and Let's Encrypt can still issue a certificate as long as the proxy passes plain HTTP requests through. ### Domains behind a load balancer With [load balancing](https://ops.vimonto.com/docs/sites/load-balancing), the domain points to the load balancer, not to the app servers. Add the domain to the site on the load balancer and to the site on each app server, but create the DNS records for the load balancer's IP address, and turn on HTTPS on the load balancer. On the app servers, the domain then shows as pointing elsewhere; that is expected. ## Point your domain automatically with a DNS integration When one of your connected cloud or DNS accounts (Hetzner Cloud, DigitalOcean, Vultr, Akamai, AWS Route 53, Google Cloud DNS or Cloudflare) manages the domain's zone, Vimonto Deploy can create the records for you. Connect the account under **Settings** → [Integrations](https://ops.vimonto.com/docs/connections/integrations); the account card shows which domains it manages. When you have DNS integrations, the hint under **Domain** says "We look the domain up at your DNS providers and set its records automatically." As you type, Vimonto Deploy fetches the domain lists of your accounts live, so a domain you just added at a provider is found too, and a **DNS** box shows whether an integration manages it. If one does, choose: - **Point it automatically with …** (the account and the zone, for example `Hetzner Cloud (example.com)`): Vimonto Deploy makes the records. This is chosen by default. - **I manage the DNS myself**: nothing changes at the DNS provider; create the records yourself as described above. If no integration manages the domain, the box says so and you create the records yourself, or add the domain to one of your DNS providers (see below). ### Add the domain to a DNS provider When none of your accounts has the domain yet, but you have DNS integrations, the box offers **Add the domain to a DNS provider**. Switch it on and choose: - **Provider**: the connected account to add it to (Hetzner Cloud, DigitalOcean, Vultr, Akamai, AWS, Google Cloud or Cloudflare). - **Zone**: the domain to create there. It defaults to the domain without its subdomain, such as `example.com` for `shop.example.com`; it must be the domain itself or a domain it ends with. The box then shows the records it will make, all **New**. When you click **Add domain**, the task first adds the zone at the provider (**Add … to …**), then creates the records, and lists in its output the nameservers to set for the zone at your registrar. Until you change the nameservers at your registrar, the provider does not answer for the domain; HTTPS follows once the DNS resolves. > [!NOTE] > At Cloudflare, creating a zone needs **Zone** → **Zone** → **Edit** on the token, and a token that reaches one Cloudflare account. Otherwise add the domain in Cloudflare yourself and choose **Refresh domains** on the account. ### Check the plan before anything changes With **Point it automatically**, the box lists every record the domain needs, with what will happen to it: | Label | Meaning | | --- | --- | | **New** | The record does not exist yet and is created. | | **Already right** | The record already points to this server; nothing changes. | | **Changes** | A record exists and is changed, or something is removed to make room. | The records are the same as when you do it by hand: an A record for the domain to the server's IPv4 address, `www.` as a CNAME to the domain when a www redirect is on, and an A record for `*.` with wildcards on. Under a record that changes, the box warns you about what it means: - what the name points to now, which stops (for example a site at another host); - an **AAAA** record that is removed, because IPv6 visitors would otherwise go to the old address; - a conflicting record that is removed to make room, such as a CNAME on the same name; - at Cloudflare, that the proxy is switched off for this name, so HTTPS and visitor addresses work. When existing records change, tick **Change these records** before you click **Add domain**. Without it, nothing is saved. Vimonto Deploy checks the records again when you click, so the plan it applies is the one you saw. ### What happens next A task, **Pointing … to …**, runs on the [activity](https://ops.vimonto.com/docs/organization/activity) page: 1. **Update DNS at …**: the records are created or changed exactly as the plan showed. Records at Cloudflare are created DNS only (not proxied). 2. **Request HTTPS**: a Let's Encrypt certificate is requested for the new domain (and the names already on the active certificate). That task first waits until the name resolves to the server, for at most 10 minutes, then requests the certificate and switches the site to HTTPS. Wildcard names are not put on the certificate, because Let's Encrypt only issues them with a DNS challenge. If the name does not resolve within 10 minutes, the certificate task fails with a message; the records are in place, so request a certificate later under **Certificates**. > [!NOTE] > The server needs a public IPv4 address to point to. Without one, the DNS box shows an error and you manage the DNS yourself. ### Which records does Vimonto Deploy remove? Vimonto Deploy remembers every DNS record it makes at a connected account, with the site, the domain and what it is for: the domain, `www.`, a wildcard, or the WebSocket address of [Reverb](https://ops.vimonto.com/docs/sites/site-features#reverb). It only ever removes those: - **Delete** a domain: exactly the records made for that domain go. The confirmation lists them. - Delete the site: all its records go, in a **Remove DNS records** step. See [site settings](https://ops.vimonto.com/docs/sites/site-settings#delete-a-site). - Switch Reverb off: its WebSocket record goes. A record that already points elsewhere and that Vimonto Deploy did not make is never overwritten by a feature such as Reverb: the task tells you to change it yourself. Only adding a domain changes existing records, after you tick **Change these records**. ## Turn on HTTPS with a free Let's Encrypt certificate 1. Make sure your domains point to the server. 2. Under **Certificates**, click **Add**, choose **Let's Encrypt** and click **Continue**. 3. Check the domains to include. Each shows whether it points to this server. 4. Click **Request**. Vimonto Deploy installs certbot if needed and requests the certificate with the webroot challenge: Let's Encrypt fetches a file over `http://` from `/.well-known/acme-challenge/`, which every site serves from `/var/www/letsencrypt`. Nothing has to stop, and password protection does not block the challenge. Once the certificate is issued, the site switches to HTTPS: - Nginx listens on port 443 with HTTP/2, TLS 1.2 and 1.3, and sends a `Strict-Transport-Security` header. - Plain `http://` requests are redirected to `https://`. - The site header shows **HTTPS**, and each domain on the certificate shows **HTTPS** in the list. Let's Encrypt certificates show **renews automatically**. certbot's timer on the server renews them before they expire and reloads Nginx. > [!WARNING] > Let's Encrypt only issues the certificate when every checked domain points to this server. If a request fails, check the DNS records, uncheck the domains that do not point here yet, and request again. Wildcard names cannot be included this way. ### After adding a domain A certificate covers the names it was issued for. When you add a domain to a site that already has HTTPS, Vimonto Deploy reminds you with **Request a new certificate**: request a new Let's Encrypt certificate that includes the new name, and it replaces the old one as the active certificate. ## Use your own certificate Click **Add** under **Certificates** and choose one of these: - **Existing certificate**: paste the **Certificate** in PEM format, followed by the intermediate certificates, and its **Private key**. Vimonto Deploy checks that the key belongs to the certificate before Nginx uses it, and reads the domains and expiry date from the certificate. - **Certificate signing request (CSR)**: choose the domains and fill in the country, state or province, city, organization and department. Vimonto Deploy creates a private key (kept encrypted) and a request to submit to your certificate authority. Once it is signed, choose **Install signed certificate** in the certificate's menu and paste it. - **Clone certificate**: use a certificate uploaded for another site in your organization, for example a wildcard certificate shared by several sites. Let's Encrypt certificates cannot be cloned. Uploaded certificates show **valid until** and their expiry date. They do not renew: install a new one before that date. ## One active certificate per site A site can hold several certificates, but Nginx serves exactly one: the active one, marked **Active**. A new certificate becomes active as soon as it is installed. In a certificate's menu you can: - **Use** an installed certificate that is not active. - **Turn off HTTPS**: the site goes back to `http://`. The certificate stays, so you can turn HTTPS on again later. - **Delete** the certificate. Deleting the active one also turns HTTPS off. If the site has a [custom Nginx configuration](https://ops.vimonto.com/docs/sites/nginx), the certificate is installed but not added to the configuration: the task log tells you the file paths to add yourself. ## Frequently asked questions ### Is SSL free? Yes. Let's Encrypt certificates are free and renew automatically. Vimonto Deploy does not charge for them. ### How long does it take before my domain works? The Nginx change takes seconds. DNS changes at your provider usually arrive within minutes, sometimes longer. The **Set up** dialog shows when each record points to your server. With a DNS integration, Vimonto Deploy waits up to 10 minutes for the records and then turns on HTTPS by itself. ### Can Vimonto Deploy create my DNS records? Yes, when the domain is managed by a connected Hetzner Cloud, DigitalOcean, Vultr, Akamai, AWS, Google Cloud or Cloudflare account. Connect it under [integrations](https://ops.vimonto.com/docs/connections/integrations), then add the domain and choose **Point it automatically with …**. Domains at other DNS providers you point yourself. ### Can I use the on-deploy.link address with HTTPS? Yes. A site created on its generated address gets a Let's Encrypt certificate automatically during setup. Otherwise the generated address is one of the site's names, so it is listed when you request a Let's Encrypt certificate, and its DNS record already points to your server. ### What if the automatic certificate fails? The site keeps working over `http://`, and you get a [notification](https://ops.vimonto.com/docs/more/notifications) that the certificate failed. Request one again under **Certificates** with **Add** and **Let's Encrypt**. ### Why does a domain show "HTTP only"? The domain is not on the active certificate yet. Request a new certificate that includes it. ### Can I serve several domains from one site? Yes. Add each one as an alias; Nginx serves the site on all of them, with each domain's own wildcard and www. options. Put them all on one certificate.