Turn on end-to-end TLS

Normally Kepeink terminates public HTTPS at its edge. With end-to-end TLS, the edge routes encrypted traffic to your agent, which holds the certificate and private key on your machine.

Before you start

Get the tunnel working at its assigned URL first. Decide which hostname needs agent-held TLS:

• Your custom domain, such as app.example.com: attach the domain first. End-to-end TLS for this hostname is free.
• The assigned Kepeink hostname: your workspace needs the e2e_tls feature grant. This setting applies to the tunnel's assigned hostname.

These choices can be used together. If the tunnel has a custom domain using a Kepeink-issued certificate, switch that domain to agent-held TLS before enabling the assigned hostname's end-to-end mode.

1. Enable it

In the dashboard, open the tunnel or its custom domain and turn on end-to-end TLS for the hostname you chose. The agent then obtains a Let's Encrypt certificate automatically. You do not need to open a port on your machine; validation travels down the existing tunnel.

If you use Docker, keep a named volume at /home/nonroot so the certificate and ACME account key survive container recreation.

2. Check the certificate

Once the hostname is active, open its HTTPS URL. In your browser's certificate viewer, check that the certificate covers the hostname. The first issuance can take a little time; later renewals are automatic.

To return to Kepeink-managed TLS, switch off end-to-end TLS for that hostname in the dashboard. A custom domain may briefly wait for a new edge certificate.