Support
Manage TLS certificates in the dashboard sidebar under Secure Tunnels → TLS Certificates.
Auto-managed certificates
- Auto-provisioned via ACME (Let’s Encrypt) for all custom domains.
- Automatic renewal before expiration.
- Wildcard certificates on Unlimited plans.
Custom certificates
Upload your own certificates in PEM format with the private key. You can set any certificate as the default for a domain and download certificate bundles from the dashboard.
Mutual TLS (mTLS)
Require client certificates for mutual TLS authentication. Configure it under Secure Tunnels → mTLS or via the Terminate TLS traffic policy rule. With mTLS both client and server present certificates for bidirectional authentication. Three verification strategies are available:
require-and-verify— strict; the client must present a certificate that verifies against the trusted CAs.require-any— a client certificate is required but not verified against a CA.request— a client certificate is optional.
Common use cases include service-to-service auth, zero-trust architectures, compliance, and internal API protection.