VaultPilot uses HTTPS on the configured public port for browser access. Automatic mode maintains a VaultPilot-managed self-signed certificate for first access and internal use. Enterprise mode checks an organization-provided PFX/P12 certificate against the configured public host and switches to it in a single step. VaultPilot checks that the certificate matches the host name or IP address; you separately confirm that client devices trust the certificate chain. Always open VaultPilot with https://.
What operators configure
| Field | Required | Purpose |
|---|---|---|
| Public host | Yes | DNS name or server host users open in the browser. |
| Public port | Yes | Default public HTTPS port is 1734; use your approved inbound port. |
| Certificate mode | Yes | Automatic uses the managed self-signed certificate; Enterprise enables the organization PFX/P12 flow. |
| HTTPS certificate package | Required for Enterprise | PFX/P12 package containing the certificate and matching private key. |
| Source passphrase | Required when the package is protected | Used only to open and check the package. |
Changing the mode alone does not replace the live certificate. Validate the Enterprise package, review the displayed validity window, and only then save Server settings.
Supported certificate package
Provide one certificate package in PFX or P12 form.
The certificate must cover the public host that users open, as a DNS name or IP address in its subject or alternative names. It must be a server certificate, not a CA certificate, and if it lists extended key usages, one of them must be server authentication. These checks show that the package can serve the host, but they do not prove that client devices trust the issuing CA.
Upload boundary and errors
Certificate upload is an Owner-only server setting. Upload exactly one .pfx or .p12 package. The file must not be empty and must be no larger than 2 MB. Repeated uploads in a short time are refused for a while; wait before trying again.
| Error | Meaning | Operator action |
|---|---|---|
| Unsupported file | The selected file is not a .pfx or .p12 package. | Export a PFX/P12 package that contains the certificate and private key, then upload that package. |
| File size | The selected package is empty or larger than 2 MB. | Re-export the certificate package and confirm its size before uploading. |
| Upload too large | The upload is over the server limit. | Confirm the package is at most 2 MB and retry with exactly one certificate file. |
| Invalid public host | Public host is blank, malformed, or not a plain host name or IP address. | Enter the DNS name or IP address users actually open; validation stops before the package is checked. |
Validation, staging, and atomic save
- Select Enterprise, enter the public host, choose the PFX/P12 package, and enter its source passphrase when required. Nothing is prepared until the host is valid.
- Choose Validate bundle. VaultPilot opens the package, checks that the private key matches, and checks the certificate type, usage and host match for the current public host.
- Compare the displayed Subject/SAN, issuer, and not-before/not-after validity window with the expected certificate. Even after the host check succeeds, confirm CA trust from a client device.
- A successful validation holds the package for at most 10 minutes, for the Owner who validated it only.
- Validate again if that time ran out, the package was already saved, it was validated by another user, or the package or passphrase changed.
- Save Server settings. VaultPilot checks the package once more against the public host being saved, then applies the setting and certificate together. A host changed after validation cannot be saved with a mismatched package. If any step fails, the previous settings and working certificate stay in place.
The source passphrase is not written to logs, audit details, or settings screens. A validated package cannot be used by another Owner, reused, or saved after it expires.
Production checklist
- Confirm first access at
https://<SERVER_HOST>:1734or your configured public HTTPS port. - Expect a browser warning while the managed self-signed certificate is still in use.
- Create or obtain the trusted certificate package outside VaultPilot.
- Confirm the host name resolves to the VaultPilot server.
- Set the public host and port in Server settings, then select Enterprise.
- Choose the PFX/P12 package and enter the source passphrase when required.
- Run Validate bundle to check the private key, certificate type and usage, and the public host match.
- Review the displayed Subject/SAN and validity window, then confirm client CA trust from a separate device.
- Save within 10 minutes of validation; validate again if that time ran out.
- After save, reopen VaultPilot at the public host and port and confirm the browser accepts the certificate.
Security notes
- Never send PFX/P12 files, private keys or certificate passwords with a support case.
- Store certificate packages on the server with restricted ACLs.
- Replace expired certificates before browser warnings appear.
- Use internal PKI for private networks or a trusted public certificate for internet-facing DNS names.
Troubleshooting
| Symptom | Check |
|---|---|
| Browser hostname warning | The certificate SAN does not match the public host. |
| HTTPS does not start | PFX/P12 password is wrong or the package is not readable. |
| Validated but cannot save | The 10 minutes may have passed, the package may already be saved, or another user validated it; validate the package again. |
| Save reports an error | Confirm that the previous working certificate is still served, then review and revalidate the new package. |
| Warning appears on first access | Managed self-signed HTTPS is still active; install a trusted PFX/P12 package or trust the issuing CA according to internal policy. |
| Works locally, not remotely | DNS, firewall or reverse proxy path is not aligned with the configured host/port. |
| Certificate accepted on server only | Client devices do not trust the issuing CA. |