Skip to content

Commit f2f7753

Browse files
alvarengasvalvarengasv
committed
Updated web cert documentation
1 parent aa1a350 commit f2f7753

1 file changed

Lines changed: 139 additions & 26 deletions

File tree

‎versioned_docs/version-3/getting-started/initial-configuration/web-certificate.mdx‎

Lines changed: 139 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,38 @@ import TabItem from "@theme/TabItem";
88

99
# Web Certificate
1010

11-
By default, TCAdmin uses a self-signed certificate for HTTPS, which causes your browser to show a security warning every time you visit the panel. This guide shows you how to replace it with a free, trusted certificate from [Let's Encrypt](https://letsencrypt.org/) so the warning goes away.
11+
By default, TCAdmin uses a self-signed certificate for HTTPS, which causes your browser to show a security warning every time you visit the panel. This guide shows you how to replace it with a trusted certificate so the warning goes away.
1212

1313
:::info What is an SSL certificate?
1414
An SSL certificate encrypts the connection between your browser and the TCAdmin panel, keeping your login credentials and data safe. A **self-signed** certificate provides encryption but isn't trusted by browsers (hence the warning). A **Let's Encrypt** certificate is free, trusted by all browsers, and auto-renews.
1515
:::
1616

17+
TCAdmin supports three ways to set up a trusted certificate:
18+
19+
| Method | Best For | Requirements |
20+
|--------|----------|--------------|
21+
| [**HTTP Validation**](#method-1-http-validation) | Most setups — fully automatic | Domain name, ports 80 & 443 open |
22+
| [**DNS Validation**](#method-2-dns-validation) | Servers behind firewalls or NAT | Domain name, access to DNS records |
23+
| [**Custom Certificate**](#method-3-custom-certificate) | Using your own certificate (purchased or from another CA) | A `.pfx` or `.p12` certificate file |
24+
1725
## Before You Begin
1826

19-
You need **one** of the following:
27+
For **HTTP Validation** or **DNS Validation**, you need:
2028
- A **domain name** pointing to your server (e.g., `panel.yourdomain.com`) — set up a DNS **A record** that points to your server's public IP address
21-
- **OR** you can use TCAdmin's built-in dynamic DNS (explained below) if you don't have a domain
29+
- **OR** you can use TCAdmin's built-in dynamic DNS if you don't have a domain (see [Dynamic DNS](#dynamic-dns) below)
30+
31+
For **Custom Certificate**, you just need your certificate file in `.pfx` or `.p12` format with the private key included.
32+
33+
## Method 1: HTTP Validation
2234

23-
You also need:
24-
- Ports **80** and **443** open and accessible from the internet (Let's Encrypt uses port 80 to verify you own the domain)
35+
This is the simplest method. Let's Encrypt automatically verifies you own the domain by connecting to your server over HTTP.
36+
37+
### Requirements
38+
39+
- Ports **80** and **443** open and accessible from the internet
2540
- No other web server (like Apache or Nginx) running on ports 80/443
2641

27-
## Step 1: Change TCAdmin to Use Ports 80 and 443
42+
### Step 1: Change TCAdmin to Use Ports 80 and 443
2843

2944
By default, TCAdmin runs on ports 31000/31001. Let's Encrypt requires your site to be on the standard web ports (80 for HTTP, 443 for HTTPS).
3045

@@ -98,55 +113,136 @@ Make sure ports **80** and **443** are open in your firewall. Let's Encrypt conn
98113
Your panel URL changes too! Instead of `https://YOUR-IP:31001`, you'll now access it at `https://YOUR-IP` (port 443 is the default HTTPS port, so you don't need to type it).
99114
:::
100115

101-
## Step 2: Generate the Certificate
116+
### Step 2: Generate the Certificate
102117

103118
1. Log in to your control panel
104119
2. Go to **Settings** > **Web Certificate**
105-
3. In the **Domains** field, enter your domain name (one per line if you have multiple)
106-
4. Optionally enter your **Email** address — Let's Encrypt will send you a reminder if your certificate is about to expire
107-
5. Check **Accept terms of service** (after reviewing the [Let's Encrypt Terms of Service](https://letsencrypt.org/repository/))
108-
6. Click **Create**
120+
3. Select the **HTTP Validation** tab
121+
4. In the **Domains** field, enter your domain name (one per line if you have multiple)
122+
5. Optionally enter your **Email** address — Let's Encrypt will send you a reminder if your certificate is about to expire
123+
6. Check **Accept terms of service** (after reviewing the [Let's Encrypt Terms of Service](https://letsencrypt.org/repository/))
124+
7. Click **Create**
109125

110126
TCAdmin will:
111-
1. Create a test certificate first to make sure everything works
127+
1. Create a test certificate first (using Let's Encrypt staging) to make sure everything works
112128
2. If the test passes, create the real certificate
113129
3. Automatically configure the web service to use it
114130

115-
:::tip Don't have a domain name?
116-
TCAdmin offers a free dynamic DNS service. Use this as your domain:
131+
### Automatic Renewal
132+
133+
Let's Encrypt certificates are valid for **90 days**. TCAdmin automatically renews HTTP certificates **30 days** before they expire — you don't need to do anything.
134+
135+
## Method 2: DNS Validation
136+
137+
Use this method if your server is behind a firewall, NAT, or you can't open port 80. Instead of connecting to your server, Let's Encrypt verifies ownership by checking a DNS TXT record that you create.
138+
139+
### Step 1: Initiate DNS Validation
140+
141+
1. Log in to your control panel
142+
2. Go to **Settings** > **Web Certificate**
143+
3. Select the **DNS Validation** tab
144+
4. In the **Domains** field, enter your domain name (one per line if you have multiple)
145+
5. Optionally enter your **Email** address
146+
6. Check **Accept terms of service**
147+
7. Click **Initiate DNS Validation**
148+
149+
TCAdmin will display one or more DNS TXT records that you need to create:
150+
151+
| Field | Example |
152+
|-------|---------|
153+
| **Domain** | `yourdomain.com` |
154+
| **Record Name** | `_acme-challenge.yourdomain.com` |
155+
| **Record Value** | `a1b2c3d4e5f6...` (a long random string) |
156+
157+
Use the copy button next to each record value to copy it to your clipboard.
158+
159+
### Step 2: Create the DNS Records
160+
161+
Log in to your DNS provider (e.g., Cloudflare, Namecheap, GoDaddy) and create a **TXT** record for each entry shown:
162+
163+
- **Name/Host:** `_acme-challenge` (or the full record name shown)
164+
- **Type:** `TXT`
165+
- **Value:** The record value shown in TCAdmin
166+
167+
:::warning DNS propagation
168+
DNS changes can take anywhere from a few minutes to several hours to propagate. Wait at least 5-10 minutes before proceeding to the next step. You can verify propagation using an online DNS checker or by running `nslookup -type=TXT _acme-challenge.yourdomain.com`.
169+
:::
170+
171+
### Step 3: Complete Validation
172+
173+
Once the DNS records are in place, click **Complete Validation** in TCAdmin. It will verify the DNS records and generate your certificate.
174+
175+
:::info Starting over
176+
If you need to cancel the DNS validation process (e.g., you entered the wrong domain), click **Cancel and Start Over** to restart.
177+
:::
178+
179+
:::note Renewal
180+
DNS validation certificates are **not** automatically renewed. You will need to repeat this process before the certificate expires (90 days). The system health indicator will warn you when your certificate is approaching expiry.
181+
:::
182+
183+
## Method 3: Custom Certificate
184+
185+
If you already have an SSL certificate (purchased from a CA or generated elsewhere), you can upload it directly.
186+
187+
### Requirements
188+
189+
- Certificate must be in `.pfx` or `.p12` format
190+
- Certificate must include the **private key**
191+
- Maximum file size: **10 MB**
192+
193+
### Upload Your Certificate
194+
195+
1. Log in to your control panel
196+
2. Go to **Settings** > **Web Certificate**
197+
3. Select the **Custom Certificate** tab
198+
4. Click **Browse** and select your `.pfx` or `.p12` file
199+
5. Enter the certificate **password** (if the certificate is password-protected)
200+
6. Click **Upload**
201+
202+
TCAdmin will validate the certificate, check that it contains a private key, and apply it to the web service.
203+
204+
:::note Renewal
205+
Custom certificates are **not** automatically renewed. You will need to upload a new certificate before the current one expires. The system health indicator will warn you when your certificate is approaching expiry.
206+
:::
207+
208+
## Dynamic DNS {#dynamic-dns}
209+
210+
If you don't have a domain name, TCAdmin offers a free dynamic DNS service. Use this as your domain:
117211

118212
```
119213
YOUR-PUBLIC-IP.dyn.tcadmin.net
120214
```
121215

122-
Replace dots in your IP with dashes. For example, if your IP is `192.168.1.100`, use:
216+
Replace dots in your IP with dashes. For example, if your IP is `203.0.113.50`, use:
123217

124218
```
125-
192-168-1-100.dyn.tcadmin.net
219+
203-0-113-50.dyn.tcadmin.net
126220
```
127-
:::
221+
222+
This works with both HTTP and DNS validation methods.
128223

129224
## Checking Your Certificate
130225

131-
After generating a certificate, the **Web Certificate** page shows:
226+
After setting up a certificate (using any method), the **Web Certificate** page shows:
132227

133228
| Field | What It Shows |
134229
|-------|---------------|
135-
| **Domain** | The domain name the certificate was issued for |
136-
| **Expires on** | When the certificate expires (Let's Encrypt certs last 90 days) |
137-
| **Issued by** | Who issued the certificate (Let's Encrypt or self-signed) |
230+
| **Domain(s)** | The domain name(s) the certificate was issued for |
231+
| **Expires on** | When the certificate expires |
232+
| **Issued by** | Who issued the certificate (e.g., Let's Encrypt, your CA) |
138233

139-
## Automatic Renewal
140-
141-
Let's Encrypt certificates are valid for **90 days**. TCAdmin automatically renews them before they expire — you don't need to do anything.
234+
The system health indicator in the bottom status bar also monitors your certificate:
235+
- **Healthy** — Certificate is valid with plenty of time remaining
236+
- **Degraded** — Certificate expires within 20 days
237+
- **Unhealthy** — Certificate has expired
142238

143239
## Troubleshooting
144240

145241
### "Website must be accessible over http on port 80"
146242

147-
The web service isn't listening on port 80. Go back to [Step 1](#step-1-change-tcadmin-to-use-ports-80-and-443) and make sure you updated the config file and restarted the service.
243+
The web service isn't listening on port 80. Go back to [Step 1 of HTTP Validation](#step-1-change-tcadmin-to-use-ports-80-and-443) and make sure you updated the config file and restarted the service. This only applies to the HTTP Validation method.
148244

149-
### Certificate generation fails
245+
### Certificate generation fails (HTTP Validation)
150246

151247
| Possible Cause | How to Fix |
152248
|----------------|-----------|
@@ -155,6 +251,23 @@ The web service isn't listening on port 80. Go back to [Step 1](#step-1-change-t
155251
| **Rate limiting** | Let's Encrypt limits how many certificates you can request per domain per week. If you've been testing repeatedly, wait an hour and try again. |
156252
| **Another service on port 80** | If Apache, Nginx, or another web server is using port 80, stop it first. Only one service can listen on a port at a time. |
157253

254+
### DNS validation fails
255+
256+
| Possible Cause | How to Fix |
257+
|----------------|-----------|
258+
| **DNS records not propagated** | Wait longer (up to a few hours) and try again. Use an online DNS checker to verify the TXT record is visible. |
259+
| **Wrong record name or value** | Double-check the record name and value match exactly what TCAdmin showed. The record name should be `_acme-challenge.yourdomain.com`. |
260+
| **Multiple TXT records** | If you have old `_acme-challenge` TXT records from a previous attempt, delete them before creating new ones. |
261+
262+
### Custom certificate upload fails
263+
264+
| Possible Cause | How to Fix |
265+
|----------------|-----------|
266+
| **Wrong format** | The certificate must be in `.pfx` or `.p12` format. If you have `.pem` or `.crt` files, convert them first using `openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem`. |
267+
| **Missing private key** | The `.pfx` file must include the private key. Re-export it with the key included. |
268+
| **Wrong password** | Make sure you're entering the correct password for the `.pfx` file. |
269+
| **File too large** | The certificate file must be under 10 MB. |
270+
158271
## What's Next?
159272

160273
- [Plugin Repository](plugin-repository.mdx) — import game configurations to start hosting

0 commit comments

Comments
 (0)