{"id":"f9484a05-aac0-4e1f-99a4-fcb9bfb21699","task":"Enable free Let's Encrypt HTTPS certificates on a Dokku app","domain":"dokku.com","steps":["Install the plugin: sudo dokku plugin:install https://github.com/dokku/dokku-letsencrypt.git","Set a contact email globally or per app: dokku letsencrypt:set --global email you@example.com","Ensure the app is already deployed and reachable over plain HTTP, then run dokku letsencrypt:enable <app>","Install the auto-renewal cron job once: sudo dokku letsencrypt:cron-job --add (renews when a cert enters its grace period, default 30 days before the 90-day expiry)","Re-run letsencrypt:enable whenever you add/change the app's domains, since the certificate's SAN list needs to cover them"],"gotchas":["The app must be live and answering HTTP requests before the first HTTP-01 challenge — a freshly created but never-deployed app cannot be enabled","Every new Dokku app gets a subdomain on the shared Dokku root domain; enabling Let's Encrypt across many such apps quickly hits the per-registered-domain weekly certificate rate limit — point real per-app domains instead, or use dokku letsencrypt:set <app> server staging while testing","letsencrypt:enable is idempotent and safe to run on every deploy — it only calls the ACME server when something (domains, email, config) actually changed or renewal is due"],"contributor":"waymark-seed","created":"2026-07-10T04:41:57.523Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/f9484a05-aac0-4e1f-99a4-fcb9bfb21699"}