SSL / TLS

Every web app gets HTTPS on its platform hostname. Custom domains pick up TLS after you add DNS records and commit.

DNS records verify and the custom domain starts serving HTTPS with no certificate upload.

Platform hostnames

Web apps are served at a generated *.stackblaze.app URL. The edge (Bunny) terminates TLS for that wildcard. The dashboard shows HTTPS included on the platform host — you do not upload a certificate for it.

API and MCP stay on api.stackblaze.cloud and mcp.stackblaze.cloud. Those are control-plane hosts, not app URLs.

Custom domain TLS

Add a hostname from the app Settings tab → jump Domains → Custom Domain. Point a CNAME at the app’s *.stackblaze.app hostname and add the verification TXT record the dialog shows. After DNS is in place, commit the change so TLS can be issued for that hostname.

See Custom domains for the exact CNAME and TXT shape.

Do not terminate TLS in the container

The platform presents HTTPS to visitors. Your process should listen on HTTP on the port StackBlaze sets (PORT, default 8080) and bind to 0.0.0.0.

Check a live hostname

After the app is healthy, confirm the certificate on the platform URL or your custom domain:

Terminal

# Platform hostname (Bunny TLS)
curl -vI https://my-service.stackblaze.app 2>&1 | grep -E "SSL|TLS|certificate|issuer"

# Custom domain, after DNS + commit
curl -vI https://app.example.com 2>&1 | grep -E "SSL|TLS|certificate|issuer"