Custom domain and TLS

A custom domain serves the bucket as a website under your hostname, for example files.example.com. It requires static hosting to be enabled on the account; without it no domain configuration is deployed.

Set up

1. In the customer portal enable static hosting and enter the domain.
2. Create a CNAME at your DNS provider: files.example.com CNAME <bucket>.<endpoint host>, for example my-bucket.fra.s3.zeroservices.eu for a bucket in FRA2. The portal's DNS check resolves the name through a public resolver and compares it with exactly this target.
3. Request the certificate. Issuance is ACME HTTP-01 with Let's Encrypt; the challenge path /.well-known/acme-challenge/ stays reachable through every filter. The certificate is deployed to the region's gateways and renewed by a daily job.

TLS modes

Mode	Behaviour
acme (default)	certificate from Let's Encrypt, HTTP is redirected to HTTPS with 301
upstream	TLS is terminated upstream, for example by ZERO-PROTECT; no certificate is issued here, HTTP is still redirected
off	no redirect, no certificate

Origin lock

With origin_lock: zero-protect the domain answers only to the ZERO-PROTECT edge addresses; every other source gets 403. Use it when the domain is fronted by ZERO-PROTECT so that the origin cannot be reached directly.

What the gateway does

Requests to the domain are rewritten to the bucket (/<tenant>:<bucket>/<path>) and served by the region's RGW. A Strict-Transport-Security header (6 months) is added to every response. Apex domains cannot carry a CNAME; use a subdomain.