Certificates and TLS

Certificate problems fall into two groups: the server terminating TLS itself, or something in front of it doing so. The first thing to establish is which one you have.

Port 80 stays open regardless. The control plane reaches your server by IP address, so it cannot use a certificate issued for your domain — and ACME renewal needs it too. Closing 80 after enabling HTTPS is the most common cause of a server going quiet while the site still loads.

If a CDN or proxy terminates TLS

Nothing on the server needs TLS at all. Leave LF_TLS unset, leave 443 closed, and let the proxy handle certificates. A certificate error in this configuration is a proxy problem, not a LockFlare one.

If the server terminates TLS (.NET)

Enabled with LF_TLS=1. Confirm what the engine actually loaded:

healthy output

[TLS] enabled — listening on 443, certificates from /etc/lockflare/certs (falling back to /etc/letsencrypt/live)
[INTERPRETER] Listening on http://0.0.0.0:80 and https://0.0.0.0:443
[TLS] loaded certificate for 'yourdomain.com' (expires 2026-10-21)

Symptom	Cause
No `[TLS]` line at all	`LF_TLS` is not set, or the engine was not restarted after setting it.
Listening on 443 but no certificate loaded	Nothing found in `LF_TLS_DIR` or the Let’s Encrypt fallback. Check the certificate exists and is readable by root.
Certificate loaded for the wrong hostname	The certificate’s name must match the domain being requested. A certificate for the apex will not serve `www` unless it covers both.
Expired	The log prints the expiry date on load. Renewal is a certbot concern; the engine reads whatever is on disk.

ACME renewal failing

Certbot writes its challenge into the webroot at LF_ACME_DIR, and the engine serves it over port 80. Both halves have to line up.

Log line	Meaning
`[ACME] challenge not found`	The engine looked in its ACME root and the file was not there. Confirm certbot’s `-w` matches `LF_ACME_DIR`.
`[ACME] could not read`	The file exists but is not readable. A permissions problem on the challenge directory.

the two must match

# what the engine serves from grep LF_ACME_DIR /var/www/interpreter/.env # default: /var/lib/lockflare/acme

what certbot writes into

sudo certbot certonly --webroot -w /var/lib/lockflare/acme -d yourdomain.com

Renewal also needs port 80 open from the internet. If issuance worked once and renewal fails later, the firewall is the first thing to check.

Node hosts

The Node engine sits behind nginx, so TLS is nginx’s job — configure certificates there as you would for any site. LF_TLS does not apply.

Keep the port 80 server block reachable rather than redirecting everything to HTTPS, or the control plane loses its path to the machine.

A domain is not serving An app keeps restarting