TLS Certificates

TLS certificates on the PushOps platform are managed automatically by cert-manager. When you configure a hostname in your Component's ingress settings, cert-manager provisions and maintains a certificate for that hostname — no manual certificate management is required.

Automatic provisioning

When you add a hostname to your Component's ingress configuration:

1. cert-manager detects the configuration.
2. It requests a certificate from Let's Encrypt.
3. The certificate is issued and stored securely.
4. Your application is served over HTTPS.

Provisioning typically completes within 1–2 minutes for publicly resolvable domains.

Automatic renewal

cert-manager renews certificates automatically before they expire. No action is required from your team.

Requirements for certificate issuance

Your domain must be publicly resolvable — the DNS record must exist and point to the platform load balancer. cert-manager cannot issue a certificate for a domain that doesn't resolve publicly.

If your domain is internal-only (not publicly resolvable), raise a request to discuss alternative approaches.

Troubleshooting

If your browser shows a certificate warning:

1. Verify your DNS record resolves to the correct load balancer address.
2. Check that your Component is healthy in SVIEW.

If both are correct and the error persists, raise a request with the hostname and the error message.

Wildcard certificates

Wildcard certificates (e.g. *.yourdomain.com) require DNS-01 challenge validation and access to your DNS provider's API. Raise a request if you need a wildcard certificate — the team will discuss configuration options with you.