TLS/SSL

Your Pulsed Media seedbox serves its control panel over HTTPS, with a certificate that renews itself through Let's Encrypt. TLS, Transport Layer Security, is the encryption underneath that padlock icon. SSL is its older name; both terms describe the same thing today, and most people still say SSL out of habit.

What TLS/SSL does

TLS encrypts the connection between your browser and a server. Without it, anyone sharing the same network, a public Wi-Fi hotspot, a compromised router, an ISP, can read traffic as plain text. A login form submitted over plain HTTP sends the password across the wire exactly as typed. The same form over HTTPS sends an unreadable stream of bytes; only your browser and the server hold the key needed to turn it back into the password.

Browser and server agree on that key during a short handshake at the start of the connection, using a certificate the server presents to prove it is who it claims to be. Everything that follows in the session, page content, login, any file transferred, rides inside that encrypted channel. The padlock in the address bar means the handshake succeeded and the certificate checked out. A broken padlock, a warning page, or "not secure" in the address bar means it did not, usually because the certificate does not match the address, has expired, or because there was no server to hand over a certificate at all.

TLS/SSL on a Pulsed Media seedbox

Your panel address, https://SERVER.pulsedmedia.com/user-USERNAME/, runs on the server's own hostname. PMSS requests a Let's Encrypt certificate for that hostname during normal provisioning and renews it automatically, well before it expires. There is nothing to configure for the panel address itself.

Two more addresses exist on every account, and both default to plain HTTP: the free, migration-stable mcx.fi permalink, and your personal subdomain for the public web folder. Opening either with https:// shows a certificate warning, because the automatic certificate above only covers the server's own hostname, not these extra names. Running ~/bin/createWebPublicCerts once over SSH requests a real certificate for the permalink; adding --with-username-hostname covers the subdomain too, at the cost of publishing your username in public Certificate Transparency logs for good. Full steps live on Permalinks on PMSS.

Pointing a domain you own at a Pulsed Media service needs a small reverse proxy in front of it, since PMSS cannot issue a certificate for a hostname it has never heard of. Custom Domains on PMSS covers that setup end to end.

Troubleshooting

My browser says the connection is not secure, or shows a certificate error. Load the page again after a minute or two. The overwhelming majority of these are not a certificate problem at all, the server was briefly unreachable, so neither your browser nor the server could complete the handshake, and a browser reports that failure as a security warning rather than a plain "can't connect." If it keeps happening after a few minutes, or you are using a custom domain pointed at your seedbox rather than the server's own address, open a support ticket with the exact URL you were loading. An actually expired certificate does happen occasionally and needs a staff fix, but it is the rare case, not the common one.

My account page shows "SSL Not Detected" or a red status next to my service. That indicator lives in your account's billing panel. It checks the certificate on your server's address and keeps the last result for a while. It turns red the moment the server stops answering, for any reason, and syncs back to green on its own schedule after the server recovers, so it can stay red for a while even once everything works again. If the seedbox itself loads fine when you try it directly, the panel will catch up; no action needed on your end.

I pointed my own domain at my seedbox and now get a certificate error. See Custom Domains on PMSS. The reverse proxy in front of your domain needs to point at a hostname that already carries a valid certificate, your mcx.fi permalink or subdomain after running createWebPublicCerts, not the bare server address.

What TLS/SSL does

TLS/SSL on a Pulsed Media seedbox

Troubleshooting

See also