Skip to main content

​
Serving a certificate

Attach the certificate to an HTTPS listener by CRN:
A listener can hold several certificates and picks one per connection by matching the client’s SNI against each certificate’s SANs. The one marked is_default is the fallback for a client whose SNI matches nothing, or that sends no SNI at all. Setting a new default demotes the previous one in the same transaction.
Detaching a certificate is refused in two cases: removing the last certificate from an HTTPS listener, and removing the current default while other certificates are still attached. Promote a replacement first.
A certificate CRN ends in certificate/<name>, so the slash must be percent-encoded as %2F when it appears in a path segment. Sent raw, it addresses a different route that does not exist.