1# TLS Commands
2
3Inspect public TLS/ACME certificate status.
4
5Gordon serves normal HTTPS fallback on TLS-capable entrypoints such as `entrypoints.edge` with `protocol = "smart_tcp"`. Certificate priority is static certificates first, then public ACME certificates, then Gordon's internal CA.
6
7ACME challenge notes:
8
9- DNS-01 (`cloudflare-dns-01`) does not require a special external port 80 edge.
10- HTTP-01 requires an HTTP-capable smart TCP entrypoint reachable on external port 80 for every hostname being validated.
11- TLS-ALPN-01 is not supported.
12
13Remote targeting uses client config or an active remote by default.
14Use `--remote` and `--token` to override. See [CLI Overview](./index.md).
15
16## gordon tls
17
18### Subcommands
19
20| Subcommand | Description |
21|------------|-------------|
22| `status` | Show public TLS certificate status |
23
24---
25
26## gordon tls status
27
28Display the current public TLS/ACME certificate status, including ACME mode,
29certificate details, route coverage, and any errors.
30
31```bash
32gordon tls status
33gordon tls status --json
34gordon tls status --remote https://gordon.mydomain.com --token $TOKEN
35```
36
37### Flags
38
39| Flag | Description |
40|------|-------------|
41| `--json` | Output as JSON |
42
43### Human Output
44
45```text
46Public TLS / ACME Status
47
48ACME: enabled
49Configured Mode: auto
50Effective Mode: http-01
51Reason: configured
52Token Source: env
53
54Certificates
55  ID: cert-abc123
56  Names: example.com, www.example.com
57  Status: valid
58  Not After: 2026-05-29 12:00:00
59
60Route Coverage
61  example.com  covered=yes  covered_by=cert-abc123
62  internal.local  covered=no  error=self-signed cert
63
64Errors
65  route internal.local has no ACME cert
66```
67
68### JSON Output
69
70```json
71{
72  "acme_enabled": true,
73  "configured_mode": "auto",
74  "effective_mode": "http-01",
75  "selection_reason": "configured",
76  "token_source": "env",
77  "certificates": [
78    {
79      "id": "cert-abc123",
80      "names": ["example.com", "www.example.com"],
81      "challenge": "http-01",
82      "status": "valid",
83      "not_after": "2026-05-29T12:00:00Z",
84      "renewal_pending": false
85    }
86  ],
87  "routes": [
88    {
89      "domain": "example.com",
90      "covered": true,
91      "covered_by": "cert-abc123",
92      "required_acme": true
93    },
94    {
95      "domain": "internal.local",
96      "covered": false,
97      "required_acme": false,
98      "error": "self-signed cert"
99    }
100  ],
101  "errors": ["route internal.local has no ACME cert"]
102}
103```
104
105### Token Source
106
107The `token_source` field indicates where the ACME token was sourced from
108(e.g., `env`, `file`, `config`). The token value is never displayed.
109
110## Related
111
112- [CLI Overview](./index.md)
113- [Status Command](./status.md)
114- [Routes Command](./routes.md)