Skip to main content

​
Architecture Overview

AutoCertify is built as a single monorepo comprising two React/Vite Single Page Applications (SPAs) and an Express/TypeScript API backed by Postgres.

​
Workspaces

  • apps/marketing: The public-facing site containing the HTTPS checker and public signup flow.
  • apps/portal: The authenticated dashboard for managing domains, DNS instructions, and developer invites.
  • apps/api: The backend API managing Postgres, Auth0 validation, DNS resolution, and Cloudflare integrations.
  • packages/ui: A shared library containing UI components used by both SPAs.

​
Certificate Issuance Model

AutoCertify issues certificates using Cloudflare for SaaS Custom Hostnames. The fallback origin is configured on the autocertify.net zone as fallback.autocertify.net.

​
External Mode (Production)

In production (CERT_ISSUANCE_MODE=external), the API creates custom hostnames by sending the minimum required payload: the hostname and SSL method/type. It deliberately omits custom origin metadata, CA bundles, and TLS overrides. The API polls Cloudflare for status updates using GET requests. AutoCertify marks domains and certificates as active only when Cloudflare reports that both the hostname and SSL status are active. It never assumes success or marks things active prematurely.

​
Internal Mode (Local Development)

For local development, CERT_ISSUANCE_MODE=internal acts as a mock. It creates a pending certificate record but will never mark the domain or certificate as active, ensuring the application behaves predictably without making external API calls.

​
Data & Persistence

The platform relies on Azure Postgres Flexible Server for primary storage. The schema handles relational data including organizations, users, team roles, clients, domains, certificates, support messages, verification links, API keys, webhooks, and audit events. Rate limiting is backed by Postgres, ensuring durability and consistency across multiple API instances.

​
Observability and Telemetry

The API and both SPAs are instrumented with Sentry for error tracking and PostHog for product analytics (using the autocertify environment marker).

​
Deployment

  • API: Packaged as a Docker container and deployed to Azure Container Apps. It connects directly to Azure Postgres with sslmode=require.
  • SPAs: Deployed as static sites to Cloudflare Pages (or Azure static hosting).