HTTPS certificates: the certificate must name the host users open

VaultPilot starts with a self-signed certificate it manages itself, so you can reach it on first access. For broad use you upload a PFX/P12 package issued by your organization. The certificate in that package has to match the DNS name or IP address users actually open.

Initial state: Automatic mode, self-signed
Production package: PFX or P12, up to 2 MB
Identity: SAN covers the opened DNS name or IP
Validation stage: 10 minutes, single use

HTTPS trust boundary linking public host, certificate identity, private key and client trust

Settle the host name before the certificate

The public host is the DNS name or IP address users type into the browser. The DNS record, the firewall, any reverse proxy, and the configured port must all lead to the same VaultPilot server. The certificate's Subject Alternative Name has to cover that name, and client devices have to trust the chain that issued it.

Automatic and Enterprise certificate modes

Automatic mode keeps a VaultPilot-managed self-signed certificate for first access and internal use. Enterprise mode validates your organization's PFX/P12 package against the public host and moves it into the live HTTPS binding in one operation. Switching the mode alone does not replace the live certificate.

What Validate bundle checks

Only an Owner can upload a certificate. Upload exactly one .pfx or .p12 file; it cannot be empty or larger than 2 MB, and too many uploads in a short time are blocked for a while. Even when every check passes, read the displayed subject, SAN, issuer, and validity dates yourself.

Saving checks the package again

A successful validation does not change the live setting. It creates a single-use stage that lasts at most 10 minutes and is bound to the Owner and organization that ran it. On save, VaultPilot checks the staged package against the host being saved and promotes the setting and file together. If any step fails, the previous settings and the working certificate stay in place. Validate again in these cases.

If the warning continues after saving

A saved setting does not mean clients already receive or trust the new certificate. Wait for any reload the interface asks for, then open the address from a separate client. Each symptom below points to a different cause.

Limits to know

Uploading a certificate does not configure DNS, the firewall, a reverse proxy, or client CA trust.
VaultPilot cannot check whether user devices trust the issuing root CA.
Never put certificate packages, their passphrases, or private keys in a support request, a document, or a screenshot.