## TLS / SSL Certificates

Setup TLS cert for different domains of your reverse proxy server names

### Hosts Certificates

Provide certificates for multiple domains reverse proxy

Server Name (Domain) Match the server name with your CN/DNS entry in certificate for faster resolve time
Public Key (.pem) or .crt files in order systems
Private Key (.key)
You have intermediate certificate? Open Conversion Tool
Certificate for domain uploaded.

#### Tips about Server Names & SNI

If you have two subdomains like `a.example.com` and `b.example.com` , for faster response speed, you might want to setup them one by one (i.e. having two seperate certificate for `a.example.com` and `b.example.com`).
If you have a wildcard certificate that covers `*.example.com`, you can just enter `example.com` as server name to add a certificate.
If you have a certificate contain multiple host, you can enter the first domain in your certificate and Zoraxy will try to match the remaining CN/DNS for you.

Current list of loaded certificates

Domain | Last Update | Expire At | DNS Challenge | Renew | Remove
--- | --- | --- | --- | --- | ---

### Fallback Certificate

When there are no matching certificate for the requested server name, reverse proxy router will always fallback to this one.
Note that you need both of them uploaded for it to fallback properly

Key Type | Found
--- | ---
Fallback Public Key |
Fallback Private Key |

Upload Default Keypairs

### Certificate Authority (CA) and Auto Renew (ACME)

Management features regarding CA and ACME

#### Prefered Certificate Authority

The default CA to use when create a new subdomain proxy endpoint with TLS certificate

Preferred CA
Let's Encrypt
ACME Email

##### Certificate Renew / Generation (ACME) Settings

####
Disabled
ACME Auto-Renewer

This tool provide you a graphical interface to setup auto certificate renew on your (sub)domains. You can also manually generate a certificate if one of your domain do not have certificate.