Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Hardening › TLS

TLS

TLS hardening

Status: File-based TLS is SUPPORTED. ACME is Enterprise and not certified.Audience: deployment engineer

Product-enforced

  • When server.tls.enabled is true, cert and key files are required to start.
  • Enterprise cookie issuance can require HTTPS (Secure HTTPS session required).
  • Agent server.verify_tls example true; allow_insecure_remote_tls default false.

Operator recommendation

  • Use an organization or publicly trusted certificate in production.
  • scripts/generate_tls_certs.sh is for lab/internal CA-style files (RSA 4096, refuses key overwrite).
  • Restart Manager after rotating files (HUP not certified for TLS re-read).
  • Keep allow_insecure_remote_tls off.

Not-yet-certified

ACME HTTP-01 + Cloudflare DNS-01 customer matrix. Community does not ship product ACME. mTLS security_level maximum is implemented, not a marketed PKI product.