SSL certificates

CRMcy uses Let's Encrypt for all TLS. The platform domain (e.g. crmcy.app) is covered by a wildcard certificate (*.crmcy.app) issued via the DNS-01 challenge; this requires Cloudflare API credentials at infra/certbot/cloudflare.ini (or any other certbot DNS plugin). Custom customer domains use the HTTP-01 challenge, served by the nginx ACME challenge snippet at infra/nginx/snippets/acme-challenge.conf.

Renewal runs daily via the cron-scheduler; certbot decides whether to actually renew based on remaining validity (typical: 30 days before expiry). After a successful renewal nginx reloads the cert without dropping connections.

Manual operations

• Issue the wildcard for the first time: infra/scripts/issue-wildcard.sh
• Force a specific domain renewal: infra/scripts/renew-certs.sh <domain>
• Inspect installed certs: docker exec crmcy_nginx ls /etc/letsencrypt/live/

If a renewal fails, the platform falls back to the existing cert and raises a Sentry alert on the operator. Investigate logs at docker logs crmcy_certbot.