One post tagged with "SSL"

Version v3.1.9.3 reworks how TLS certificates work on the platform: certificates are now account-owned objects you manage in one place, like AWS ACM, instead of being tied to a single load balancer. Attach the same certificate to as many listeners as you like, or put more than one certificate on a single :443 listener using SNI. Alongside that, the Support Ticket System gains AI triage on every new ticket and a live resource-context card so staff can see exactly what state a customer's instance, database or load balancer is in without leaving the ticket, Load Balancers pick up a configurable health-check Host header and three separate stability fixes, the admin System Settings page is fully redesigned, and the AI Assistant adds an Ollama Cloud preset.

Account Certificates​

Certificates move out of individual load balancers and into their own account-level store, closing the biggest gap in the load balancer feature: serving two unrelated domains from the same :443 listener.

• [Feature] Certificates Are Account-Owned - A new Networking > Certificates page lists every certificate on the account, independent of any single load balancer. Upload a certificate or issue one from Let's Encrypt once, then reuse it across every listener that needs it. The list paginates on the server, so large certificate stores stay fast.
• [Feature] Multiple Certificates per Listener via SNI - A :443 listener now holds an ordered set of certificates - one default, plus any number of additional certificates served by SNI (Server Name Indication). domainA.com and domainB.com can finally share one IP and one listener.
• [Feature] Full Upload Validation - Uploading a certificate checks that the private key actually matches the certificate, that any supplied CA chain genuinely signs the leaf certificate, and rejects certificates that have already expired, instead of accepting bad material and failing later at the load balancer.
• [Feature] Let's Encrypt Issuance via a Load Balancer - Request a free Let's Encrypt certificate by choosing which of your load balancers should answer the HTTP-01 challenge. The resulting certificate is account-owned and reusable on any other listener; renewal reuses the same load balancer automatically, and if that load balancer is later deleted the certificate is clearly marked as renewal-blocked instead of failing silently.
• [Feature] Expiry Email Notifications - Uploaded certificates that are approaching expiry trigger an email to the account owner so renewal never comes as a surprise. Let's Encrypt certificates keep renewing themselves.
• [Feature] Copyable Certificate IDs - Every certificate row in the user and admin lists now shows its ID with a one-click copy button, ready to paste into an OpenTofu certificate_ids reference or an MCP tool call.
• [Feature] OpenTofu Provider v0.3.0 and MCP Coverage - The OpenTofu provider gains a first-class iaas_certificate resource and a certificate_ids list on iaas_lb_frontend; the MCP server adds tools to list, upload and request Let's Encrypt certificates. This is a breaking provider change: the old iaas_lb_certificate resource is gone in favor of the account-level model.
• [Fix] Legacy Certificates Now Show Their Expiry - Certificates created before this release never had their expiry date, fingerprint or domain parsed out of the stored PEM, so they showed a blank Expires column and were invisible to the renewal cron and certificate alerts. Existing rows are backfilled automatically.
• [Fix] Kubernetes-Issued Certificates No Longer Pile Up - The Kubernetes load balancer bridge minted a brand-new certificate row on every reconcile pass for custom and inline certificates, accumulating dozens of duplicates over time on active clusters. It now updates the same row in place, and Let's Encrypt reuse checks respect expiry and ownership correctly.

Certificate Monitoring​

• [Feature] New "Certificate" Alert Resource Type - Monitoring gains a dedicated certificate resource type with days_until_expiry and validity/status metrics, so you can get paged before a certificate actually lapses instead of after.
• [Feature] One-Click "Alert When Expiring" - The Certificates list has a one-click action that opens the alert rule form pre-filled for that certificate, so setting up expiry monitoring takes one click instead of a trip through the Monitoring section.

Support​

• [Feature] AI Triage on Every New Ticket - When enabled, the assistant reviews a new ticket as soon as it is created and files a staff-only internal note with an assessment, a suggested reply your team can load straight into the composer with one click, and a list of suggested next actions. Triage can optionally also re-run whenever the customer posts a new reply.
• [Feature] Resource Context on the Admin Ticket Page - A new context card shows the live status, metric sparklines, recent tasks, and a merged alerts-and-events timeline for every resource a customer has linked to their ticket - instance, load balancer, managed database, Kubernetes cluster, volume, object-storage bucket or VPC - plus recent admin actions taken against it. Staff no longer need to open a separate tab to see what state a customer's server is actually in.
• [Feature] AI Triage Is Grounded in That Same Context - The exact same resource data backing the context card is handed to the AI as trusted platform context, so its assessment and suggested actions cite real evidence - a failed backup task, a recent alert, an unusual metric - rather than generic guesses.
• [Feature] On-Demand "Run AI Analysis" - A "Run AI analysis" button on the ticket page queues a fresh triage pass at any time, independent of the automatic triggers, for tickets that need a second look.
• [Feature] Rebuilt Ticket Interface - The admin and customer ticket pages share a rebuilt thread, composer and properties rail, with neutral status and priority chips. AI-generated notes and staff-only system rows (assignment changes, SLA breaches) are visually distinct and, as always, never rendered to the customer.

Load Balancers​

• [Feature] Configurable Host Header for Health Checks - HTTP health checks can now send a specific Host header, fixing false-unhealthy backends behind name-based virtual hosts that reject requests with no Host header.
• [Fix] A Bad Certificate Can No Longer Block a Whole Listener - Previously, one certificate whose private key no longer matched its certificate could get a load balancer stuck in configuring on every retry. A mismatched certificate is now skipped during config generation instead of shipping a configuration the load balancer would refuse outright.
• [Fix] Stale Callbacks Can No Longer Overwrite Newer State - Every configuration push now carries a token; a delayed callback from a superseded retry is ignored instead of flipping an already-recovered load balancer back to error.
• [Fix] Duplicate and Orphaned Backends Can No Longer Break a Config - Only backends actually referenced by a frontend are rendered, each backend name is emitted once, and a backend is automatically rolled back if creating its frontend fails - closing a path where repeated failed attempts left several identically-named backends behind and broke the whole configuration.

AI Assistant​

• [Feature] Ollama Cloud Provider Preset - Ollama Cloud joins the existing local Ollama preset in the provider dropdown, alongside its endpoint and key format.
• [Fix] Tool-Call Compatibility with Strict Providers - Some OpenAI-compatible providers (Ollama Cloud among them) reject a replayed tool call whose arguments aren't a JSON object, which could poison an entire conversation after a no-argument tool call. Arguments are now normalized to a proper JSON object before they're sent to the provider.

Admin​

• [Feature] Redesigned System Settings Page - Settings now use a vertical, searchable navigation down the side, two-column section cards with the explanation sitting right next to the control it describes, and a sticky unsaved-changes bar with discard and save actions that tracks changes across the entire page rather than one tab at a time.

Instances and Platform​

• [Feature] Import Doctor - Imported Windows virtual machines that were built for a different hypervisor (VMware, Hyper-V, bare metal) can now be detected and repaired offline. When a foreign OS is detected, a "Repair imported OS" banner appears on both the admin and user instance pages; the repair runs against the stopped disk and is safe to re-run.
• [Feature] Bandwidth Overage Throttling for Self-Provisioning Packs - An instance that exceeds its self-provisioning pack's bandwidth allowance can now be network-throttled instead of suspended outright, and is automatically restored once usage resets.
• [Feature] Proxmox Hardening - Security group sync is more resilient to transient failures, ISO downloads are prefetched with checksum verification, and network rate limits are now applied correctly through the instance lifecycle on Proxmox hypervisors.
• [Fix] Templated Email Formatting - Single line breaks in templated emails (support notifications, backup alerts, and similar) no longer collapse into a single run-on paragraph, and the footer falls back to your platform's company name when no application name is set.
• [Fix] Platform Reliability - Node-readiness checks are more accurate before scheduling operations onto a hypervisor, VPN Gateway tunnels now clamp their MTU to avoid fragmentation over site-to-site links, and Kubernetes-provisioned internal load balancers keep their source-range restrictions pinned correctly.
• [Fix] HostBill Integration - The HostBill module now supports package changes (upgrades/downgrades) and fixes several renewal and response-handling edge cases.
• [Fix] Self-Provisioning and Storage Form Polish - Self-provisioning pack settings no longer drift type on save, and small validation and layout tweaks landed on the storage backend and plan forms.