# SSL / TLS

## Edge Certificates

Nginx on `192.168.10.156` terminates TLS using Let's Encrypt material under `/etc/letsencrypt/live/torbatyar.ir/`.

Platform hosts force HTTP → HTTPS. ACME challenges stay on port 80 (`/.well-known/acme-challenge/`).

## Tenant Subdomain SSL

When a tenant domain is provisioned and `SSL_PROVISION_ENABLED=true`, Core Celery task SSHs to the Nginx host and runs `provision_ssl.py` to expand the certificate SAN list. Map file `torbatyar-tenant-ssl.map` marks hosts ready for HTTPS redirect.

Config keys: `SSL_PROVISION_HOST`, `SSL_PROVISION_USER`, `SSL_PROVISION_PASSWORD`, `SSL_PROVISION_SCRIPT`.

Scripts/configs:

- `infrastructure/nginx/provision_ssl.py`
- `infrastructure/nginx/torbatyar.ir.conf`
- `infrastructure/nginx/torbatyar-tenant-ssl.map`

## Custom Domains

Custom domains may be stored as `pending` until DNS verification ships. SSL automation for arbitrary custom domains follows the same expansion model once DNS points correctly.

## Related Documents

- [ADR-009](../architecture/adr/ADR-009.md)
- [Production](production.md)
- [Multi-Tenant Architecture](../architecture/multi-tenant-architecture.md)