dokku-tls-letsencrypt

Dokku TLS / SSL & Let's Encrypt

Version: Dokku 0.37.x. Safety: certs:* (except report/show) and all letsencrypt:* mutations change the live TLS endpoint — confirm before running. Let's Encrypt has issuance rate limits, so do not loop enable. certs:report, certs:show, letsencrypt:list, letsencrypt:active are read-only.

Prerequisites

1. The app has a domain set (dokku domains:set <app> app.example.com).
2. DNS for that domain points at the Dokku host.
3. Ports 80 and 443 are reachable (Let's Encrypt HTTP-01 needs port 80).

Custom certificates (core certs plugin)

dokku certs:report <app>                     # read-only: issuer, expiry, presence
dokku certs:add    <app> server.crt server.key   # or pipe a tarball on stdin
dokku certs:update <app> server.crt server.key
dokku certs:remove <app>
dokku certs:generate <app> app.example.com   # CSR + self-signed (dev/testing)
dokku certs:show   <app> crt                 # print the crt (or: key)

Automated Let's Encrypt (dokku-letsencrypt plugin)

This is the official community plugin dokku/dokku-letsencrypt, not part of core Dokku. If it is not installed, install it first (host root):

sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git

Confirm with the operator before installing host plugins.

dokku letsencrypt:set <app> email [email protected]   # required contact email
dokku letsencrypt:enable <app>                       # issue + install cert (also renews)
dokku letsencrypt:active <app>                       # read-only: is LE active?
dokku letsencrypt:list                               # read-only: secured apps + expiry
dokku letsencrypt:auto-renew [<app>]                 # renew if near expiry
dokku letsencrypt:revoke <app>
dokku letsencrypt:cleanup <app>                      # remove stale cert dirs
dokku letsencrypt:disable <app>

Enable automatic renewal

Add the periodic auto-renew cron job once (host-wide):

dokku letsencrypt:cron-job --add

This schedules letsencrypt:auto-renew so certificates renew before they expire.

Verify (read-only)

dokku certs:report <app>          # or: dokku letsencrypt:list
curl -vI https://app.example.com  # confirm valid chain + expiry from a client

Cautions

• Re-running enable repeatedly can hit Let's Encrypt rate limits — check letsencrypt:list first.
• Renewal requires the HTTP-01 challenge path to stay reachable; do not block port 80 at the firewall/proxy.