Transport Layer Security (TLS) certificates

Configure HTTPS for your applications on TurboStack - Let's Encrypt (HTTP and DNS validation) or bring your own certificate, wildcards, and renewal.

TurboStack secures your applications with HTTPS. You choose how each application gets its certificate on the Applications tab, under an application's Hostnames settings (cert_type).

The certificate options on an application's Hostnames tab
The certificate options on an application's Hostnames tab

Certificate types

cert_type Use it for
letsencrypt Recommended. Free, automatic certificates that renew themselves.
selfsigned Internal/test sites where a trusted certificate isn't required.
custom Bring your own certificate - buy one from any authority and import the certificate, chain and private key (GUI or YAML).

Let's Encrypt (automatic HTTPS)

Set cert_type: letsencrypt and publish. TurboStack requests the certificate and renews it automatically before it expires. List every hostname the site answers to in server_name (space-separated) so they are all covered.

Validation challenge: HTTP vs DNS

Under Advanced settings you can choose the cert_challenge:

  • http (recommended, most compatible) - validates by serving a file over HTTP. The domain must resolve to the server.

  • dns - validates via a Domain Name System (DNS) record. Use it for wildcard certificates, or for domains that don't yet point to the server. When your domain uses Hosted Power DNS, TurboStack creates the validation record automatically. For domains on Cloudflare, you supply a Cloudflare API token so TurboStack can create the record for you.

Wildcards and multiple domains

  • Multiple domains/subdomains: add them all to server_name.
  • Wildcard (*.example.com): requires the DNS challenge.

Bring your own certificate

Most sites only need Let's Encrypt. To use a certificate you bought yourself, buy it from any certificate authority, then set cert_type: custom and import it - either in the GUI (the application's Hostnames settings) or in YAML. Paste the private key and the full chain in order: your certificate, then the intermediate certificate(s), then the root. If the publish fails, the intermediates are usually in the wrong order.

Generate a CSR

To buy a certificate you provide a Certificate Signing Request (CSR).

Generate the key and CSR on the server so the private key never leaves it. Create a config file server.san (use *.example.com as commonName for a wildcard):

[ req ]
default_bits = 4096
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[ req_distinguished_name ]
countryName = BE
organizationName = Example Company
commonName = www.example.com
[ req_ext ]
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.example.com
DNS.2 = example.com
openssl req -sha256 -new -newkey rsa:4096 -nodes -keyout server.key -out server.csr -config server.san

Give server.csr to your certificate authority.

Extract a certificate from a PFX file

If you were given a .pfx (Personal Information Exchange) file, split it into the certificate and key to paste them in:

openssl pkcs12 -in certificate.pfx -nokeys -out certificate.pem -nodes   # certificates
openssl pkcs12 -in certificate.pfx -nocerts -out priv-key.pem  -nodes    # private key

Build a PFX file

To hand a certificate to a Windows or Internet Information Services (IIS) system, combine the private key, certificate and chain into one .pfx:

openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt -certfile chain.pem

Buy a certificate through the Customer Center

You can also order a paid certificate, still commonly sold as a Secure Sockets Layer (SSL) certificate, through the Customer Center at portal.hosted-power.com. The portal generates the Certificate Signing Request (CSR) for you and handles the paperwork, then hands you the issued certificate to import.

To order a certificate:

  1. Open the Customer Center and start a new certificate order.

  2. Choose the certificate product. Unless you were told to get a specific type, choose a Sectigo Positive SSL certificate.

  3. Provide the CSR. If you already have one, paste it. If not, choose the option to generate a new CSR now, and the portal creates it for you.

  4. Enter the organization data for the requesting organization. For a Sectigo Positive SSL certificate this data is not verified against public records.

  5. For Certificate Common Name, enter the domain you want the certificate to cover.

  6. Choose the approver email address for domain-control validation (see below).

Domain-control validation

The certificate authority confirms you control the domain by sending a validation email. The approver address must be on the root domain of the requested domain, and it must be one of these five addresses:

  • admin@example.com
  • administrator@example.com
  • hostmaster@example.com
  • webmaster@example.com
  • postmaster@example.com

After you complete the order, the validation email arrives at the address you chose. Follow its instructions to confirm the request. Once validated, the certificate is usually issued within about 10 minutes and becomes available in the Customer Center. Import it into your application as a custom certificate (see Bring your own certificate).

Redirecting to HTTPS

On TurboStack the HTTP-to-HTTPS redirect is handled for you once a certificate is active - see Force HTTPS. Also set your application's site URL to https:// so it generates secure links.

© 2026 Hosted Power — TurboStack