Certificate generation

Northflank uses Let's Encrypt to provision TLS certificates on-demand, generated by Let's Encrypt. Certificates are created automatically and renewed before they expire, with 2048-bit RSA encryption.

Your custom domains need a linked service port, valid DNS, and a certificate before they can serve HTTPS traffic. VPC-routed subdomains require the VPC certificate workflow or a supported imported or wildcard certificate.

Your custom domains will be subject to Let's Encrypt's rate limits .

• Certificates per registered domain: you can request 50 certificates per week for the same registered domain. This limit is applied to the root domain, and any subdomains will count towards the same limit. For example, subdomain1.example.com and subdomain2.example.com will both count towards the limit for example.com.

Please keep these limits in mind when creating new subdomains on Northflank and generating Let's Encrypt certificates for your domains via other channels.

You can reduce the number of certificates you need to generate by configuring a domain to use wildcard certificates. Wildcard certificates allow your subdomains to share a certificate, and are ideal for dynamically generating subdomains in Northflank templates and preview environments.

HTTP-01 proves domain control through a public HTTP request. It cannot validate a VPC-routed subdomain, even when the service port also has public exposure.

DCV means Domain Control Validation through DNS. Northflank uses a CNAME record, a DNS alias, to complete certificate challenges without public access to the workload. For automatic certificate generation, the default is HTTP-01 on public ingress and DCV on VPC ingress.

Create a subdomain with DCV

These steps apply when the subdomain manages its own certificate. Northflank's CDN must remain disabled. For wildcard redirect routing, the parent domain must already use VPC ingress. If the full subdomain name exceeds 63 characters, the final DNS target is available only after creation. Use the record from the saved subdomain:

1. In the creation form, select DCV (CNAME delegation to Northflank) under Certificate generation method.
2. Click Add subdomain.
3. Open the subdomain configuration.
4. In your DNS provider's public zone, create the CNAME shown under DCV delegation record.
5. Add the separate ownership and routing records that Northflank requests.
6. Click Verify DCV record to make sure that the record resolves.
7. Complete domain and subdomain verification.
8. From the subdomain configuration, assign its base path (/) to a VPC-only port.
9. If the VPC routing confirmation appears, click Assign backend.
10. Wait for certificate issuance before sending HTTPS traffic.

This first path assignment selects VPC under the routing conditions. For a port exposed on both paths, use the PUT workflow in that guide to select VPC before linking it.

After a PUT request, retrieve the subdomain with GET /v1/domains/{domain}/subdomains/{subdomain}. When certificateValidationMethod is dcv, this GET response includes dcvRecord.record (DNS name) and dcvRecord.target (DNS target). Keep the CNAME record for certificate renewals. Selecting DCV or VPC routing does not create this record in your DNS provider.

Change an existing certificate method

For a verified subdomain with its own certificate, open its configuration with the settings cog. To change to DCV:

1. Before changing the certificate method or ingress target, wait for any certificate generation to finish.
2. In Certificate generation, select DCV (CNAME delegation to Northflank) under Validation method.
3. Create the CNAME shown under DCV delegation record in your DNS provider.
4. Click Verify DCV record to make sure that it resolves.
5. After verification, click Update.

If you switch from an imported certificate, Northflank asks you to remove it. Click Remove and switch to delete that certificate and request a new one through DCV.

Before selecting VPC ingress, replace an HTTP certificate method with DCV or a supported imported certificate. Northflank blocks HTTP validation on VPC-routed subdomains. A change of ingress target does not remove the need for valid DNS and certificates.

Use imported or wildcard certificates

A subdomain with its own certificate can use Imported (customer-provided certificate).

Before importing, wait for any certificate generation to finish. Open the subdomain configuration:

1. In Certificate generation, select Imported (customer-provided certificate) under Validation method.
2. Supply a certificate chain that covers the subdomain name and its matching, unencrypted private key.
3. Click Import certificate.
4. If the replacement confirmation appears, click Replace and import.

For API updates, use the certificate import flow rather than a method-only update.

Domains can also use wildcard certificates through DCV or import. Child subdomains use the parent's certificate in these modes. Per-subdomain certificate methods require a subdomain that manages its own certificate, without TLS passthrough. TLS passthrough sends encrypted traffic to the workload without terminating it at ingress.

See Public and VPC ingress for availability and cluster requirements.

Instead of using Northflank's automated certificate provisioning you can import your own TLS certificates, giving you full control over certificate management when required.

This approach is suitable if you already manage certificates externally (e.g. via Let’s Encrypt, DigiCert, Sectigo, GlobalSign, or other trusted CAs), or your organisation does not allow automated certificate generation.

In the domain creation form, select Wildcard via Imported Certificate under Certificate generation. Supply the certificate chain and private key before clicking Add domain grouping. See the wildcard certificate workflow for the full steps, including DNS verification.

Any new subdomains you create under the domain will use your own imported certificate, rather than a Northflank-generated Let's Encrypt certificate. Your certificate will need to cover any subdomains you want to add, see wildcard certificate generation for more information.

To replace an imported wildcard certificate, open the settings for the domain. Expand Certificate Import. Paste the new certificate chain and private key into their fields. Click Update to use the new certificate.