TLS, mTLS & Caching
TLS Certificates
Manage TLS certificates in the dashboard sidebar under Security → TLS Certificates. Ngris auto-provisions certificates via ACME (Let's Encrypt). You can also upload custom certificates.
Auto-Managed
- Auto-provisioned via ACME (DNS-01) for custom domains connected with DNS-provider credentials (auto mode)
- Automatic renewal before expiration
- Each auto-mode certificate covers the domain and its wildcard (
example.comand*.example.com), on every plan that includes custom domains
Custom Certificates
Upload your own certificates (PEM format) with private key. Set any certificate as the default for a domain. Download certificate bundles from the dashboard. Domains in manual mode (you add the CNAME at your own DNS provider) use an uploaded certificate, because Ngris can't complete a DNS-01 challenge without provider credentials.
| Name | Status | Expires |
|---|---|---|
| Let's Encrypt wildcard | Valid | Jan 12, 2027 |
| Uploaded certificate | Expiring | Nov 2, 2026 |
Certificate Upload
Mutual TLS (mTLS)
Require client certificates for mutual TLS authentication. Upload the client CAs you trust in Security → mTLS, then pick a mode in the endpoint's Mutual TLS settings — see Mutual TLS.
With mTLS, both client and server present certificates for bidirectional authentication. Modes: required (refuse clients without a valid certificate), optional (ask for one, accept clients without), or disabled. mTLS works on HTTP(S) endpoints only, not on TCP or UDP tunnels.
mTLS works on every HTTPS request, whether the client speaks HTTP/1.1, HTTP/2 or HTTP/3. It also covers the endpoint's deploy previews: when an app's main endpoint requires client certificates, its preview URLs answer 403, because a preview address can't ask for a certificate. If your plan no longer includes client certificates, endpoints that require them refuse all connections until client certificates are back on your plan or mTLS is turned off for the endpoint.
Let ngris issue the certificates
No CA of your own? Let ngris create one and issue a certificate for each device:
- In Security → mTLS, click Create certificate authority and name it, for example Company laptops.
- On the Client certificates tab, click New certificate for each device: download a file for a browser or phone (its password is shown once), or paste the device's signing request. Or run
ngris client-cert request --ca "Company laptops" --name laptop-annaon the device, which keeps its key on the device. - Trust the CA in the endpoint's Mutual TLS settings, like any other CA.
Revoke a lost device's certificate on the Client certificates tab or with ngris client-cert revoke <certificate_uuid>: every endpoint refuses it from the device's next request or connection. Your app learns which device is calling from the X-Ngris-Client-Cert-* headers and the signed X-Ngris-Signature token; authorise on its aud and on sub or its client_cert claim, never on host. The full steps are in Let ngris issue the certificates.
Mutual TLS
Require clients to present a certificate signed by one of your trusted Certificate Authorities during the TLS handshake.
| Name | Expires |
|---|---|
| Corporate Device CA | Mar 1, 2029 |
Cache Management
Manage cached responses for endpoints with caching enabled. Access from the dashboard under Endpoint Settings → Overview → Response Cache.
Cache Stats
View the current number of cached entries and cache configuration status for each endpoint.
Cache Purge
- Purge All — Clear the entire cache for an endpoint
- Purge by Path Pattern — Selectively purge cached responses matching a regex path pattern (max 500 characters). Example:
/api/v1/.*purges all cached responses under/api/v1/