SSL & certificates — Paylood Documentation

Paylood secures your domains over HTTPS automatically. Three modes are available.

SSL modes

Mode	Description	Use case
`auto`	Let’s Encrypt certificate generated and renewed automatically (via Caddy/Traefik)	Recommended
`custom`	You import your certificate and private key	Companies with an internal PKI
`none`	No certificate	Local tests, plain HTTP

Capture à venir

en/domains-ssl

Cette capture illustrera la vue correspondante. Elle est générée automatiquement par le pipeline Playwright.

SSL mode selection when attaching a domain

In the Domain step (or project Settings), choose the Automatic mode.
Make sure the domain is verified and points to your server.
Deploy: Paylood configures the reverse proxy, which obtains the certificate and forces HTTPS redirect.

Tip

For an automatic *.paylood.app subdomain, HTTPS is enabled on first deployment, with no action from you (on-demand TLS).

Choose the Custom mode.
Paste the certificate content (full chain, including intermediate certificates).
Paste the matching private key.
Save and deploy.

Important

The private key is sensitive: Paylood stores it encrypted server-side. Never paste a key belonging to another service.

Automatic Let’s Encrypt: renewal is fully handled by Caddy/Traefik. No action required.
Custom certificate: renew it with your authority and replace it in the settings before expiry.

With an active certificate, all HTTP traffic is redirected automatically to HTTPS by the reverse proxy.

Problem	Likely cause	Fix
Certificate not obtained	Domain not yet verified / DNS propagating	Verify the domain then redeploy
“Too many requests” error	Let’s Encrypt rate limit reached	Wait a few hours then retry
Custom certificate rejected	Key and certificate do not match	Check the key/certificate pairing

Certificate acquisition errors do not prevent deployment: your app stays reachable over HTTP, and the certificate is retried on the next deployment.