Certificates

Zappocity gets and renews its TLS certificates by itself from Let's Encrypt (or another ACME CA), using the short-lived profile so a leaked key is only useful for a few days.

How names are validated

DNS-01 first. When the operator sets CORPSUITE_ACME_DNS_PROVIDER (today route53) and CORPSUITE_ACME_DNS_ZONE, every name in that zone is validated by publishing a TXT record. This works before any web traffic reaches the server and is the only way to get a wildcard certificate.
HTTP-01 or TLS-ALPN-01 otherwise. Names outside the zone, or any name whose DNS-01 attempt fails, are validated over port 80 or 443 instead. This needs the name to resolve to the server already.

Customer domains use the second path. (Automatic DNS publishes a domain's records with its own Route53 key; its certificates still use HTTP-01 or TLS-ALPN-01.)

With DNS-01 set up, the server also keeps a wildcard certificate for its zone (*.<zone>) and for the team-site bases in it (*.f.<base>, *.d.<base>), so portal hosts and team sites need no certificate each.

Which names get certificates

The server's own host name, at start-up.
mail., autoconfig., autodiscover. and mta-sts. under every hosted domain, at the first connection.
Teams' own addresses for webmail, the team manager, forums and wiki (Your own addresses), at the first visit; webmail and team manager names only once a check finds them pointing here. Names under domains that are not hosted are refused, so nobody can make the server request certificates for them.

AWS permissions for Route53

Give the server a role or key that can change only the one hosted zone: route53:ChangeResourceRecordSets and route53:ListResourceRecordSets on arn:aws:route53:::hostedzone/<zone-id>, route53:GetChange on arn:aws:route53:::change/*, and route53:ListHostedZonesByName on * (that call cannot be limited to one zone). Zappocity never stores these credentials; they come from the standard AWS_* variables or the instance role.

Today the provider and zone are environment variables. They move into the platform settings, editable in the SaaS admin panel, when those arrive in M1.