> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/civo/enable-https.md).

# enable-https

Put a real Let's Encrypt **wildcard** certificate on the network's bastion and make its nginx terminate TLS. The DNS-01 challenge is **provider-pluggable** — the deployment's public DNS can live wherever you keep it (Route 53, Hetzner DNS, Cloudflare).

## Syntax

```bash
rumi cloud civo enable-https \
  --api-key <token> \
  --region <region> \
  --network <network> \
  --keyPair <keypair> \
  --domain <domain> \
  --dns-provider <route53|hetzner|cloudflare> \
  --dns-credentials <credential> \
  [options]
```

## Options

| Option              | Short | Description                                                                     | Default  |
| ------------------- | ----- | ------------------------------------------------------------------------------- | -------- |
| `--api-key`         | `-k`  | The Civo API token to use (or set `CIVO_API_TOKEN`)                             | Required |
| `--region`          | `-r`  | The Civo region (e.g. `FRA1`)                                                   | Required |
| `--network`         | `-n`  | The name of the environment whose bastion to secure                             | Required |
| `--keyPair`         | `-K`  | The network SSH key pair                                                        | Required |
| `--domain`          | `-d`  | The base domain to secure; the wildcard cert covers `<domain>` and `*.<domain>` | Required |
| `--dns-provider`    | `-P`  | The DNS provider hosting the domain: `route53`, `hetzner`, or `cloudflare`      | Required |
| `--dns-credentials` | `-C`  | The provider credential for the DNS-01 challenge (format per provider, below)   | Required |
| `--email`           | `-m`  | Let's Encrypt account email for expiry notices                                  | none     |
| `--force`           | `-f`  | Re-point a bastion already secured for a DIFFERENT domain                       | `false`  |

### `--dns-credentials` format by provider

| Provider     | `--dns-credentials` value                                         |
| ------------ | ----------------------------------------------------------------- |
| `route53`    | `<accessKeyId>:<secretKey>[:region]` (default region `us-east-1`) |
| `hetzner`    | the Hetzner DNS API token                                         |
| `cloudflare` | the Cloudflare API token                                          |

## Example

```bash
# DNS for the domain lives in AWS Route 53
rumi cloud civo enable-https \
  --api-key $CIVO_API_TOKEN \
  --region FRA1 \
  --network my-cloud \
  --keyPair rumi \
  --domain rumi-https.n5corp.ai \
  --dns-provider route53 \
  --dns-credentials "AKIA...:wJalr...:us-east-1" \
  --email ops@example.com
```

## Notes

* The bastion runs `certbot certonly --<provider>` for a **wildcard** DNS-01 cert; renewal is hands-free (a certbot-renew timer replays the challenge with the stored credential). The credential is written **root-only** on the bastion.
* **Rumi does not manage public DNS.** Pointing the public name at the bastion — e.g. `*.<domain>` or `<service>.<domain>` → the bastion's public IP — is **your job**, in whatever DNS hosts the domain. `enable-https` only proves control of the domain (the DNS-01 challenge) to issue the cert.
* Use a **tightly-scoped credential**: for Route 53, an IAM key limited to `route53:ChangeResourceRecordSets`/`ListHostedZones`/`GetChange` on that zone. It lives on the bastion for issuance *and* renewal.
* Run it after [launch-bastion](/rumi-cli/commands/cloud/civo/launch-bastion.md).
* A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs `--force`.

## See Also

* [launch-bastion](/rumi-cli/commands/cloud/civo/launch-bastion.md)
* [deploy](/rumi-cli/commands/cloud/civo/deploy.md)