ZeroSSL & Certificates

In the modern web, TLS/SSL encryption is mandatory. However, managing certificate lifecycles, especially at an enterprise scale with thousands of subdomains, is a notoriously fragile process.

RasnuOS natively integrates with the ACME protocol to provide fully automated, zero-touch SSL certificate provisioning and renewal.

Why We Chose ZeroSSL

While Let's Encrypt is a popular choice for hobbyists, enterprise infrastructure requires higher reliability. RasnuOS partners with ZeroSSL as our primary Certificate Authority for several critical reasons:

1. No Severe Rate Limits: Let's Encrypt enforces strict rate limits (e.g., 50 certificates per registered domain per week). For a SaaS platform provisioning hundreds of tenant subdomains daily, this is a catastrophic bottleneck. ZeroSSL removes these arbitrary limits.
2. REST API Integration: ZeroSSL provides a highly robust REST API alongside the standard ACME protocol, allowing the RasnuOS Control Plane to monitor issuance status and quotas natively.
3. 90-Day Lifecycles: Like Let's Encrypt, ZeroSSL issues 90-day certificates, encouraging automated rotation rather than relying on humans to remember to renew 1-year certificates.

Wildcard Certificates & DNS Challenge

Standard HTTP challenges require your server to be publicly accessible on Port 80 to verify domain ownership.

However, if your servers are in a private VPC or behind a strict firewall, the HTTP challenge will fail. RasnuOS solves this natively via DNS Challenges.

If you have connected a supported DNS provider (like Cloudflare or AWS Route 53), RasnuOS will automatically write the required TXT verification records to your DNS zone, securely provisioning Wildcard Certificates (*.example.com) without ever exposing your server's Port 80 to the internet.

Auto-Renewal

The SSL auto-renewal engine runs continuously in the background. 14 days before any certificate expires, the RasnuOS Control Plane automatically triggers the ACME renewal process, provisions the new certificate, and gracefully reloads your web server (Nginx/Apache)—guaranteeing zero downtime and zero expired certificates.