SSL/TLS

Every new site starts with a self-signed certificate so HTTPS works immediately (with a browser warning). Replace it with a real certificate under Settings → Domain & SSL, or with Actions → Issue SSL at the top of the site page.

Extra domains (aliases)

Add names like www.example.com or an old domain under Domains, one per line. International names are converted to punycode automatically (bücher.example → xn--bcher-kva.example). A name can belong to only one site.

• Redirect to the main domain (default) — aliases answer with a 301 redirect to the main domain, keeping the path.
• Off — aliases serve the same site.

Issue the certificate again after adding aliases: one certificate covers the main domain and every alias. If you edited the vhost by hand, add the names to server_name yourself.

Let's Encrypt

1. Point the A (and AAAA, if you use IPv6) record of the domain and every alias to the server.
2. Click Let's Encrypt (or Renew Let's Encrypt when one is already installed).

Before contacting Let's Encrypt, the panel checks that every name resolves to this server and shows which ones do not, with the record to add or change and where: Add an A record test → 203.0.113.10 in Cloudflare when the zone's name servers are Cloudflare's, otherwise the DNS host of the zone. The names are asked straight from the zone's own name server, so a record you just added counts at once (a resolver may remember "no record" for up to half an hour); if that server cannot be reached, the server's resolver is used. The same check runs while you type the domain in Add site. Behind a proxy such as Cloudflare the names resolve to the proxy; use Issue Let's Encrypt anyway in that case. The request runs in the background — progress is shown on the site's Overview.

XAXA runs certbot with the webroot method on port 80, links the certificate into the site's config folder and reloads nginx. Certbot's systemd timer renews certificates automatically and reloads nginx after each renewal.

After the first certificate, HTTP is redirected to HTTPS — unless you have edited the vhost by hand, in which case your vhost is left alone.

Troubleshooting

• Connection refused / timeout — port 80 must be reachable. Check your provider's firewall.
• DNS does not point here yet — the record is missing, still propagating, or points elsewhere. The warning lists each name and the address it resolves to.
• Too many certificates — Let's Encrypt rate limits apply per domain; wait and retry.
• Cloudflare proxy — set the record to "DNS only" while issuing, or use a Cloudflare Origin certificate as a custom certificate.

Certificates list

Domain & SSL → Certificates lists every certificate of the site with its type (Let's Encrypt, Imported, Self-signed), the domains it covers, the expiry date and whether this server serves it (Serving). The serving certificate is always the first row; behind Cloudflare it reads Yes · to Cloudflare, because Cloudflare — not the browser — receives it. Click Install on any row to switch to it, for example from an imported certificate back to Let's Encrypt and the other way round. Stored certificates that are not installed can be deleted.

Behind Cloudflare

When every name of the site resolves to Cloudflare's proxy (orange cloud), the SSL page says Proxied through Cloudflare instead of a DNS warning. The check runs as soon as the page opens (and again with Test Cloudflare): it requests the site through Cloudflare and reads both certificates over TLS, so the page shows what visitors and Cloudflare actually get rather than a description of the setup:

• Visitor ⇄ Cloudflare — issuer, common name and expiry of the edge certificate, plus whether it covers the domain (*.example.com covers one label only).
• Cloudflare ⇄ this server — the certificate served on port 443 with this site's SNI, compared with the installed certificate's SHA-256 fingerprint (Matches the installed certificate / Served certificate differs from the installed one).
• Page — HTTP status, whether Strict-Transport-Security is sent, and how many resources the page loads over http:// (mixed content).

The result of the HTTP request itself:

Result	Meaning
Cloudflare works	Cloudflare reaches this server over HTTPS.
Redirect loop	SSL/TLS mode is Flexible: Cloudflare uses HTTP, the site redirects to HTTPS. Use Full (strict).
525	Cloudflare cannot complete the TLS handshake with this server (port 443, certificate).
526	Full (strict) mode, but the installed certificate is not valid for the domain. Import a Cloudflare Origin certificate that covers it.
521–523	Cloudflare cannot reach this server (firewall, wrong IP in DNS).
Mixed content	The page itself returns HTTP 200, but it links images, scripts or stylesheets over http://. Browsers then mark the page not secure even though both TLS connections are fine; serve those resources over HTTPS.

Cloudflare DNS from the panel

With a Cloudflare token saved under Instance → Cloudflare, admins see a Cloudflare DNS card on this page: the site's A record, where it points and whether it is proxied. Create (DNS only) / Create (proxied) add a missing record pointing to this server, Turn the proxy on / Switch to DNS only flip the orange cloud, and Point to this server (after a confirmation) changes a record that points elsewhere. Add site creates the record of a new domain that has none yet, but never replaces an existing one.

Why does my browser show Google Trust Services, not my certificate?

With the orange cloud on, there are two TLS connections: visitor ⇄ Cloudflare and Cloudflare ⇄ your server. The browser only sees the first one, so it shows Cloudflare's edge certificate (issued by Google Trust Services or Let's Encrypt and renewed by Cloudflare). The certificate installed here, for example a Cloudflare Origin certificate valid until 2041, protects the second connection; browsers do not trust it, so it never appears there. Test Cloudflare confirms that the second connection works. To make browsers see the server's own certificate, set the record to DNS only and use Let's Encrypt.

HTTPS options

• HSTS — browsers use only HTTPS for the domain for one year (Strict-Transport-Security: max-age=31536000). Needs a certificate browsers trust (Let's Encrypt or a public CA); an imported self-signed or Cloudflare Origin certificate is refused. Turn it on only when HTTPS works on every name of the site.
• HTTP/3 (QUIC) — available when the server's nginx is built with HTTP/3 (nginx -V lists --with-http_v3_module); the installer then opens UDP 443. The Ubuntu 24.04 nginx package is built without it, so the switch stays off there.

Both options and the page cache rewrite the default vhost. If the vhost was edited by hand, add the directives yourself or reset the vhost first.

Imported certificates do not renew by themselves: the panel e-mails admins 30 days before one expires (Let's Encrypt: 14 days, as a safety net for failed renewals).

Import a certificate

Click Import and paste the certificate (including the intermediate chain) and its private key in PEM format. While you paste, the dialog shows the names it covers, its issuer and expiry, whether the key belongs to it and which names of the site it does not cover. XAXA installs it only when the key matches, it has not expired and it covers the site's main domain (an alias it misses gets a browser warning), and keeps a copy in the list. The certificate it replaces is kept too, so you can switch back.

Administrators see two tabs: From library lists the library certificates (below), the ones that cover this site first; the others are shown but cannot be chosen. Paste works as above, with Keep in the library to use the certificate on other sites later. A certificate already imported on a site goes into the library with the archive icon in its row (Save to library), without pasting it again.

Certificate library

Admin → Certificates keeps a certificate once (a wildcard, a Cloudflare Origin or a purchased certificate) and installs it on every site it covers:

• Add certificate — paste the certificate and its key, optionally with a name. The key is written only to /etc/xaxa/certificates/<id>/ (root, mode 600) and never shown again; the panel database keeps the names, issuer and expiry. The library is part of the panel backup.
• Apply — choose sites in the side panel. They are grouped as Covered, Partly covered (the main domain is covered, some aliases are not; they are listed) and Not covered (cannot be chosen). Select all covered picks every covered site. The summary says how many sites change and which of them move away from Let's Encrypt (Let's Encrypt keeps renewing in the background; switch back from the site's list any time). All chosen sites are installed with one nginx reload (a site whose HTTPS settings change, such as its first trusted certificate, also gets its vhost rewritten); a site that cannot take the certificate is reported and the others go ahead.
• Replace — add the renewed certificate in place of the old one. With Install on the sites that use it, those sites switch over; the old certificate leaves the library once no site serves it. Sites the renewal does not cover keep the old one.
• Remove — deletes the library copy. A certificate that a site still uses cannot be removed: switch those sites to another certificate first.
• Add site — when a library certificate covers the domain you type, the form picks it under HTTPS certificate, and it is installed as soon as the site exists. A clone keeps the library certificate of its source when that covers the new domain.

Admins get one notice 30 days and 7 days before a library certificate expires, and one when it has expired; the menu marks the page while one expires within 30 days. Only administrators can use the library: it holds keys for many sites. Site users keep importing their own certificates.

Wildcards follow the browser rule: *.example.com covers shop.example.com, not example.com itself and not a.shop.example.com.

Cloudflare Origin certificate

An Origin certificate is trusted only by Cloudflare. While the DNS record is proxied (orange cloud), browsers connect to Cloudflare and see Cloudflare's edge certificate (for example issued by Google Trust Services), not the one you installed; the Origin certificate secures the connection from Cloudflare to your server. Set SSL/TLS → Full (strict) in Cloudflare. To check what the server itself serves:

openssl s_client -connect SERVER_IP:443 -servername example.com </dev/null | openssl x509 -noout -issuer -dates

The installed files are /etc/nginx/xaxa/sites/<domain>/cert.pem and key.pem (mode 600); stored certificates are kept in certs/<id>/ next to them.