Every organisation is reached at a free address under the platform’s domain. You can also connect a domain you own, such as iot.example.com, so members and customers open Hermetry under your name. This page explains both, the DNS records you create, and how certificates are handled.
Open Domains in the Organisation part of the menu (address /admin/domains). Viewing needs the Admin role; adding and deleting a custom domain needs the Owner role.
Your free address
The card Your free address shows <slug>.<platform domain>: “Always available, on every plan. It cannot be removed.” It is served under the platform’s own certificate and needs no DNS work from you. It keeps working whatever happens to a custom domain, so it is always your way back in.
The slug was chosen when the organisation was created. See Organisations.
Add a custom domain
Custom domains are available when your plan includes them. The page then says “Your plan includes up to n custom domains.”; otherwise it says “Custom domains are not included in this plan”.
- Select Add Domain.
- Enter the Domain name: “Enter the full domain or subdomain.”, for example
iot.example.com. Select Add Domain. - Create the records the page shows at your DNS provider (below).
- Open the domain and select Verify DNS (or Re-verify DNS). On success the page says “Domain verified successfully.”
- Wait a few minutes for the certificate, then select Force SSL check on the domain page. The domain starts to serve as soon as a check sees its certificate working; without Force SSL check that happens at the next periodic check, which can take some hours.
The records to create
| Record | Purpose | Example |
|---|---|---|
| CNAME for the domain itself | Points your domain to Hermetry, so browsers reach it and the certificate can be issued. The page shows the target under DNS Setup Instructions: “Create a CNAME record pointing to …” | iot.example.com CNAME <target shown on the page> |
| DNS Challenge Record | Proves you own the domain. “Add this record at your DNS provider to prove ownership.” The detail page shows its Name, Type and Value. | TXT: _verification.iot.example.com = verify=<token> |
The challenge is a TXT record by default. An administrator can switch new domains to a CNAME challenge under the domain settings (Preferred DNS Challenge: TXT record or CNAME record), for DNS services that restrict TXT records. A pending challenge is valid for 24 hours; after that, verify again to get a new one.
“DNS changes may take up to 48 hours to propagate.” If verification fails (“Verification failed. Check your DNS settings.”), check the records with a DNS lookup tool and try again later.
Note
Use a subdomain such as iot.example.com. A bare domain (example.com) cannot carry a CNAME record at most DNS providers.
Certificates
You do not upload certificates. Once a domain is verified and points to Hermetry, the platform obtains a certificate for it, checks every day that it is served, and renews it automatically a few days before it expires. The domain page shows the SSL / TLS Certificate card: SSL status, Issuer, Issued at, Expires at and Last checked. Force SSL check checks again now.
Owners and admins are told when a certificate is about to expire and its renewal failed. SSL Expiry Warning (days) (default 30) sets when a certificate is flagged SSL Expiring.
Statuses
| Domain status | Meaning |
|---|---|
| Pending | Added, ownership not proven yet. Does not serve. |
| Verified | Ownership proven. Serves once its certificate is seen working. |
| Active | Serving. |
| DNS Failed | A periodic check found the challenge record gone. Restore it and select Re-verify DNS. |
| Inactive | Switched off. Does not serve. |
| Paused (not in plan) | “Paused: the current plan does not include this domain”. It does not serve and links use your free address. “Its settings are kept, and it comes back automatically when the plan includes it again.” |
| SSL status | Meaning |
|---|---|
| No SSL | No certificate yet. |
| SSL Pending / Provisioning | Being obtained. |
| SSL Active | Valid and served. |
| SSL Expiring | Expires within the warning window. |
| SSL Expired / SSL Failed | Not usable: check that the CNAME still points to Hermetry. |
The Timeline tab lists verification and certificate events. Reports shows certificate expiry and verification age for all domains.
Primary domain and links
One domain is marked Primary. Links in e-mails and notifications use the primary domain while it serves, otherwise your free address, so a link always lands on an address that works. The primary domain cannot be deleted; when a deleted custom domain was primary, the free address becomes primary again.
Delete a custom domain
Open the domain and select Delete domain. “This action permanently removes the domain mapping and its stored verification token.” Traffic through it stops at once. Remove the DNS records afterwards.
Limits
| Setting | Meaning |
|---|---|
| Plan limit | The number of custom domains your plan includes. It wins over the setting below. |
| Max Custom Domains | A lower limit your organisation can set when the plan states none. |
| Max Subdomains | The limit for extra subdomains. |