Automatic TLS for all services
Every service on your Aureus cluster is served over HTTPS. TLS certificates are provisioned and renewed automatically using cert-manager with Let's Encrypt as the default Certificate Authority. No manual steps, no expiry reminders.
Certificate lifecycle
Let's Encrypt certificates are valid for 90 days. cert-manager initiates renewal 30 days before expiry — automatically, with no downtime. The old certificate remains active until the new one is successfully provisioned and verified.
Custom domains
When you add a custom domain, cert-manager detects it via the Kubernetes Ingress resource and issues a certificate within minutes of DNS propagation. ACME HTTP-01 or DNS-01 challenges are handled transparently depending on your configuration.
Wildcard certificates
Wildcard certificates (e.g. *.example.com) are supported via DNS-01 challenge. This requires API access to your DNS provider. We support Route 53, Cloudflare, and most major providers. Contact support to configure this.
Private CAs
For internal services that require certificates from a private or enterprise CA, we support custom CA integration via cert-manager's ACME, Vault, or Venafi issuers. This is available on Cluster M and Cluster L.
TLS version and cipher suites
Our ingress is configured to support TLS 1.2 and 1.3 only. Older protocols are disabled. Cipher suites are configured following Mozilla's Modern compatibility profile.