SSL certificates

Every URL Gigadrive Network generates is served over HTTPS. There is no certificate to request, install, or renew, and no per-application step that can fail halfway.

HTTP is redirected

A request to http:// is redirected to https:// at the edge, before it reaches your Function. Your code never sees a plaintext request, so a framework-level HTTPS redirect adds a second hop for no benefit. Drop it.

The certificate covers one level

The wildcard is *.gigadrive.app, which matches a single label. api.my-app.gigadrive.app sits two levels under the apex and is not covered, which is why a production label containing a dot is rejected at the point you enter it rather than handed to you as a URL that fails its TLS handshake. Deployment URLs has the full label rules.

Issuance

Certificates come from Let's Encrypt. A CAA record at the apex of gigadrive.app names it as the only authority permitted to issue for the zone, wildcards included, so no other CA can issue a certificate for an address your application serves on. Issuance and renewal are handled for you, so nothing about the schedule is yours to track.

When a URL will not load

One wildcard certificate covers every generated URL, so a URL that does not respond is almost never a certificate problem. Two causes account for most of it:

• The production label is reserved but not live. The label is saved and the URL exists, but no active production deployment sits behind it yet. Deploy to production.
• The deployment behind the URL was deleted. A branch or production URL whose target is gone resolves as not found. Deploy the branch again, or check the application still has an active production deployment.

Each custom domain gets its own Let's Encrypt certificate, issued and renewed for you. A domain that fails to get one shows the reason in the console.

CAA records on a custom domain

A CAA record on your own domain decides which certificate authorities may issue for it. A domain without CAA records needs nothing. If it has any, Gigadrive Network requests a certificate only when they allow Let's Encrypt:

• One issue record must name letsencrypt.org, for example 0 issue "letsencrypt.org". Parameters after a ; in its value also apply, as the following items describe.
• If that record sets validationmethods, the list must include http-01.
• The record must not set accounturi. It pins a Let's Encrypt account that you cannot know, so it blocks issuance.
• A record with the critical flag, 128, and a tag that the certificate authority does not recognize blocks issuance.

A domain whose CAA records block issuance fails with cert_blocked_caa. If the CAA lookup itself fails at your DNS provider, the domain shows dns_lookup_failed and the check repeats; a failed lookup never counts as having no CAA records.