Feature request: Support multiple local TLS certificates (domain-based selection) #127

New Issue

adam · 2025-12-29T14:25:31+01:00

adam commented

2025-12-29 14:25:31 +01:00

Originally created by @henryxrl on GitHub (Dec 22, 2025).

I’d like to request support for multiple local TLS certificates in GoDoxy, with domain-based matching.

Background

Right now, when using:

autocert:
  provider: local
  cert_path: /path/to/fullchain.pem
  key_path:  /path/to/privkey.pem

GoDoxy can only load a single certificate. This works fine for simple setups, but becomes limiting in more complex environments.

Use Case

I have multiple valid certificates, already issued elsewhere (e.g. via Traefik / ACME), such as:

/app/certs/example1.com/
  ├─ fullchain.pem
  └─ privkey.pem

/app/certs/example2.com/
  ├─ fullchain.pem
  └─ privkey.pem

These certificates cover different domain scopes, for example:

*.example1.com (public / external)
*.example2.com (internal / split-horizon DNS)

At the moment, I have to choose one certificate and lose correct TLS for the other domain set.

Requested capability

Support multiple local certificates, with automatic selection based on SNI / domain matching.

Conceptually something like:

autocert:
  provider: local
  certificates:
    - domains:
        - example1.com
        - "*.example1.com"
      cert_path: /app/certs/example1.com/fullchain.pem
      key_path:  /app/certs/example1.com/privkey.pem

    - domains:
        - example2.com
        - "*.example2.com"
      cert_path: /app/certs/example2.com/fullchain.pem
      key_path:  /app/certs/example2.com/privkey.pem

or alternatively:

directory-based auto-loading (/app/certs/<domain>/)
or explicit mapping, whichever fits GoDoxy’s architecture better

Why this matters

Enables split-horizon DNS setups
Allows clean internal vs external TLS
Avoids forcing everything into a single wildcard cert
Matches real-world deployments where cert issuance is delegated (Traefik, Caddy, ACME outside GoDoxy)

This would make GoDoxy much easier to adopt as a drop-in reverse proxy in existing infrastructures.

Originally created by @henryxrl on GitHub (Dec 22, 2025). I’d like to request support for multiple local TLS certificates in GoDoxy, with domain-based matching. ### Background Right now, when using: ```yaml autocert: provider: local cert_path: /path/to/fullchain.pem key_path: /path/to/privkey.pem ``` GoDoxy can only load a single certificate. This works fine for simple setups, but becomes limiting in more complex environments. ### Use Case I have multiple valid certificates, already issued elsewhere (e.g. via Traefik / ACME), such as: ```text /app/certs/example1.com/ ├─ fullchain.pem └─ privkey.pem /app/certs/example2.com/ ├─ fullchain.pem └─ privkey.pem ``` These certificates cover different domain scopes, for example: - `*.example1.com` (public / external) - `*.example2.com` (internal / split-horizon DNS) At the moment, I have to choose one certificate and lose correct TLS for the other domain set. ### Requested capability Support multiple local certificates, with automatic selection based on SNI / domain matching. Conceptually something like: ```yaml autocert: provider: local certificates: - domains: - example1.com - "*.example1.com" cert_path: /app/certs/example1.com/fullchain.pem key_path: /app/certs/example1.com/privkey.pem - domains: - example2.com - "*.example2.com" cert_path: /app/certs/example2.com/fullchain.pem key_path: /app/certs/example2.com/privkey.pem ``` or alternatively: - directory-based auto-loading (`/app/certs/<domain>/`) - or explicit mapping, whichever fits GoDoxy’s architecture better ### Why this matters - Enables split-horizon DNS setups - Allows clean internal vs external TLS - Avoids forcing everything into a single wildcard cert - Matches real-world deployments where cert issuance is delegated (Traefik, Caddy, ACME outside GoDoxy) This would make GoDoxy much easier to adopt as a drop-in reverse proxy in existing infrastructures.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/godoxy-yusing#127