Certificates
Certificates are the TLS certificates your load balancer listeners end TLS with. Import a certificate and its private key once, then attach it to as many listeners as you like. Certificates are in the dashboard under Certificates.
Web apps, their custom domains and a Kubernetes cluster's managed gateway get their certificates from the platform on their own: they never appear on this page.
Import a certificate
Choose Import certificate and fill in:
- Name: a label for the console, 1 to 64 characters.
- Certificate chain (PEM): the certificate first, then each intermediate that issued the one before it.
- Private key (PEM): the unencrypted key that matches the certificate.
Paste each one, or use Choose file; a file's text lands in the field, where you can still edit it. Each field takes up to 64 KiB. The bundle is checked before anything is stored, and the private key is stored encrypted and never shown again.
What is accepted
| Format | PEM text. In the chain, anything around the certificate blocks is ignored |
| Private key | RSA from 2048 to 4096 bits, or EC on P-256 or P-384, unencrypted |
| Chain | Leaf first: each certificate must be issued by the one after it |
| Expiry | A certificate that has already expired is refused |
An encrypted key, a key of another type, and a bundle in another format, such as a .pfx or .p12 file, are refused: convert them to unencrypted PEM first.
The platform checks the bundle, not the names on it: it is yours to make sure the certificate covers the names clients connect with. A self-signed certificate, or one from your own certificate authority, is accepted too, for clients that trust it. Include the intermediates: a certificate without them is accepted, but clients that do not have them refuse it.
When an import is refused, the console says why:
| Message | What to do |
|---|---|
| That is not a valid PEM certificate chain and key | Check that the chain is leaf first and the key is an unencrypted RSA or EC key of a supported size |
| The private key does not match the certificate | Paste the key that belongs to this certificate |
| This certificate has already expired | Import the renewed certificate |
| This certificate is already in the workspace | Use the one you imported before |
| This workspace has reached its certificate limit | Delete a certificate you no longer use |
The list
Each certificate shows its Name with its key type, such as rsa-2048 or ec-p256, its Subject, the Names it covers, when it Expires, and how many Listeners use it. The search box matches names, subjects and covered names.
| Status | Means |
|---|---|
| Active | More than 30 days left |
| Expiring soon | 30 days or less left |
| Expired | Past its expiry date |
Attach it to a listener
Attach certificates when you add a TLS (terminated) listener, or later with Edit listener. A listener takes up to 20 certificates, matched to clients by the server name they send, and its Default certificate serves clients that send none. See TLS and certificates.
One certificate can serve listeners on several load balancers at once.
Expiry and renewal
The workspace's owners get an email when a certificate has 30 days left, and again when it expires. Nothing is detached when it expires: listeners keep serving it, and clients refuse it from then on.
To renew:
- Import the renewed certificate.
- On each listener that uses the old one, choose Edit listener, tick the new certificate and make it the Default if the old one was.
- Delete the old certificate.
Rename and delete
From a certificate's menu:
- Rename changes its label only. The certificate itself cannot be edited: import a new one to replace it.
- Delete certificate removes it and its private key for good; type
confirmto confirm. A certificate attached to a listener cannot be deleted, so detach it first.
A certificate marked Managed is issued and renewed by Sahabti for one of your instances. It cannot be renamed, deleted or attached to a listener, and it goes away with its instance.
Limits
| Imported certificates per workspace | 50 |
| Certificates per TLS listener | 20 |
| Each PEM field | 64 KiB |
Managed certificates do not count towards the 50.
Who can do what
| Owner | Admin | Developer | Viewer | |
|---|---|---|---|---|
| See certificates | ✓ | ✓ | ✓ | ✓ |
| Import, rename and delete certificates | ✓ | ✓ | — | — |
| Attach certificates to listeners | ✓ | ✓ | — | — |
An API token carries the certificate scope with create, read, update for renaming, and delete.
From the API and MCP
The API has /v1/certificates to list, import, read, rename and delete certificates, and MCP has list_certificates, import_certificate, rename_certificate and delete_certificate; set_lb_listener_certificates attaches them. Reading a certificate returns its chain, never its private key.