Appwrite uses Let's Encrypt to auto-generate TLS certificates for your Appwrite instance to ensure your API traffic is appropriately encrypted. For Appwrite to properly generate certificates, a few conditions need to be met.
If you're still struggling with your certificates, check the Appwrite certificates worker log. You can do that with the following command:
Appwrite auto-generates a certificate for your main domain when you first visit it. If your browser shows an insecure connection warning, you must proceed to trigger certificate generation. The domain in environment variable _APP_DOMAIN is considered your main domain. If you didn't set this variable, the first domain you visit would be marked as the main domain for your Appwrite instance. Appwrite follows this concept of the main domain to prevent generating certificates for domains you don't own. Keep in mind that you can always add additional domains as Custom Domains in your project settings to enable certificate generation for any domain.
Certificate renewal is done as a part of the Appwrite maintenance task. Unless modified with environment variable _APP_MAINTENANCE_INTERVAL, this task runs every 24 hours. During this task, Appwrite looks for certificates due for renewal and renews them. One maintenance cycle only attempts to renew up to 200 certificates to respect the Let's Encrypt API limit. Every Let's Encrypt certificate is valid for 90 days, but Appwrite starts to renew them 30 days before the expiration.
There are many reasons why certificate generation could fail, such as incorrect DNS settings, hitting Let's Encrypt API limit, or a failed HTTP ACME challenge. Every certificate generation failure is attempted again in the next renewal cycle, but only up to 5 attempts. If you need to run certificate generation for a domain beyond the attempts limit, you can use the manual generation method.
Since Appwrite generates and renews certificates automatically, a manual generation is seldom required. A manual generation can be useful when you hit the API limit and don't want to wait for the next maintenance cycle to renew the certificate. Use the following command to generate a certificate for your main domain:
If you want to generate a certificate for a specific domain, pass it as a parameter into the command:
Dev Environment and Localhosts
You can't issue a signed certificate for localhost. This is because nobody uniquely owns that hostname and not an Appwrite specific limitation, just the way the internet works. By default, Appwrite will issue a self-signed certificate that is good enough for development.
When using a self-signed certificate, you should enable `client.setSelfSigned()` method in your SDK of choice. This will allow your application to trust and connect with your local Appwrite server.