Turn on end-to-end TLS

By default, Kepeink's edge terminates HTTPS for your assigned hostname. With end-to-end TLS the agent terminates TLS on your machine instead, using its own Let's Encrypt certificate. Kepeink passes the encrypted bytes straight through to the agent, so the certificate's private key is generated on your machine and never leaves it.

Turn this on when you want the TLS session to reach all the way to your own host — for example to keep the certificate and key entirely under your control.

Requirements

• A tunnel with a custom domain attached, because the agent's certificate is issued for a name you control. Set that up first with Add a custom domain.
• The agent must be able to complete Let's Encrypt's HTTP validation. Kepeink forwards the validation requests down the tunnel to the agent for you.

1. Enable it on the tunnel

In the dashboard, open the tunnel and turn on end-to-end TLS. Kepeink switches the tunnel to pass the raw TLS connection through to the agent rather than terminating it at the edge.

2. Let the agent obtain a certificate

The agent runs its own ACME client. On the next connection it requests a Let's Encrypt certificate for your domain, completes the validation Kepeink forwards to it, and stores the certificate and key locally on your machine.

3. Verify

Once the certificate is issued, load your domain and inspect the certificate in your browser — it is the one the agent obtained, served from your machine. You can confirm the chain from the command line too:

echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -issuer -subject

Notes

• The private key is created and kept on the machine running the agent; it is never transmitted to Kepeink.
• The agent renews the certificate automatically before it expires.
• Because Kepeink no longer terminates TLS for this tunnel, the certificate lifecycle is handled entirely by the agent on your host.