SSL Configuration

ZyveraWeb supports HTTPS with TLS 1.3 and TLS 1.2. SSL is configured per-site rather than globally — each virtual host can have its own certificate.

Config Settings

SSL is configured under each site entry in sites:

sites:
  - domain: "example.com"
    dir: "site/example"
    ssl:
      cert: fullchain.pem
      key: privkey.pem

Certificate Location

SSL files are stored per-domain in plugins/ZyveraWeb/ssl/<domain>/:

plugins/ZyveraWeb/
└── ssl/
    └── example.com/
        ├── fullchain.pem    # X.509 certificate (full chain)
        ├── privkey.pem      # Private key (PEM format)
        ├── user.key         # ACME account key (auto-generated)
        └── ...

Certificate Formats

Supported private key formats (via BouncyCastle):

• PKCS#8 PrivateKeyInfo
• PEM Key Pair

How Per-Site SSL Works

When at least one site has an ssl block configured:

1. An HTTPS server starts on the configured public host:port.
2. An HTTP server starts on 127.0.0.1 (internal, auto-assigned port).
3. All public traffic enters through HTTPS. The internal HTTP server is used for ACME HTTP-01 challenges and internal forwarding.
4. The plugin reads each site's certificate and key from the ssl/ folder and creates per-certificate SSL contexts.
5. When a request arrives, the matching site's SSL context is used for the TLS handshake (SNI).

When no site has SSL:

• Only an HTTP server runs on the public host:port.

Port Considerations

• Standard HTTPS port is 443 (may require root/admin).
• If using a non-standard port, users must specify it in the URL (e.g., https://example.com:8443).

Auto-Renewal

The ACME client issues certificates but does not automatically renew them. You should set up a cron job or scheduled task to run the ACME workflow before the 90-day expiration.

See Automatic SSL for setting up Let's Encrypt certificates.