The Last Spike Online / 16 July 2026
The first TLS certificate is not the same task as the hundredth renewal
Production TLS needed two distinct states: bootstrap certificate issuance and normal renewal. On the first run there is no certificate yet, so the assumptions of the steady-state system do not apply.
Situation
Automated HTTPS setup has a classic chicken-and-egg problem. The reverse proxy wants to load a certificate that does not exist yet, while issuing that certificate requires the domain to expose a reachable challenge path. Starting the finished production configuration immediately can therefore fail before certificate issuance even has a chance to begin.
Approach
I gave initial certificate issuance its own bootstrap step with minimal HTTP availability. Only after successful issuance did the system switch to the final HTTPS configuration. From that point onward, renewal could become part of the normal runtime because the required certificate files and directory structure already existed.
Outcome
TLS setup became deterministic without manually editing the proxy configuration back and forth. The difference between bootstrap and steady state was documented, so the same process could be repeated on a new server.