1# TLS Commands
2
3Inspect public TLS/ACME certificate status.
4
5Remote targeting uses client config or an active remote by default.
6Use `--remote` and `--token` to override. See [CLI Overview](./index.md).
7
8## gordon tls
9
10### Subcommands
11
12| Subcommand | Description |
13|------------|-------------|
14| `status` | Show public TLS certificate status |
15
16---
17
18## gordon tls status
19
20Display the current public TLS/ACME certificate status, including ACME mode,
21certificate details, route coverage, and any errors.
22
23```bash
24gordon tls status
25gordon tls status --json
26gordon tls status --remote https://gordon.mydomain.com --token $TOKEN
27```
28
29### Flags
30
31| Flag | Description |
32|------|-------------|
33| `--json` | Output as JSON |
34
35### Human Output
36
37```text
38Public TLS / ACME Status
39
40ACME: enabled
41Configured Mode: auto
42Effective Mode: http-01
43Reason: configured
44Token Source: env
45
46Certificates
47  ID: cert-abc123
48  Names: example.com, www.example.com
49  Status: valid
50  Not After: 2026-05-29 12:00:00
51
52Route Coverage
53  example.com  covered=yes  covered_by=cert-abc123
54  internal.local  covered=no  error=self-signed cert
55
56Errors
57  route internal.local has no ACME cert
58```
59
60### JSON Output
61
62```json
63{
64  "acme_enabled": true,
65  "configured_mode": "auto",
66  "effective_mode": "http-01",
67  "selection_reason": "configured",
68  "token_source": "env",
69  "certificates": [
70    {
71      "id": "cert-abc123",
72      "names": ["example.com", "www.example.com"],
73      "challenge": "http-01",
74      "status": "valid",
75      "not_after": "2026-05-29T12:00:00Z",
76      "renewal_pending": false
77    }
78  ],
79  "routes": [
80    {
81      "domain": "example.com",
82      "covered": true,
83      "covered_by": "cert-abc123",
84      "required_acme": true
85    },
86    {
87      "domain": "internal.local",
88      "covered": false,
89      "required_acme": false,
90      "error": "self-signed cert"
91    }
92  ],
93  "errors": ["route internal.local has no ACME cert"]
94}
95```
96
97### Token Source
98
99The `token_source` field indicates where the ACME token was sourced from
100(e.g., `env`, `file`, `config`). The token value is never displayed.
101
102## Related
103
104- [CLI Overview](./index.md)
105- [Status Command](./status.md)
106- [Routes Command](./routes.md)