Trust
TLS that renews itself and keeps keys out of enforcement
ArxLayer handles certificate issuance, renewal, and rotation for your domains, separate from the layer that inspects traffic. Enforcement references each certificate as an opaque value, so the WAF never resolves it to a private key.
The problem
Certificates fail quietly, then loudly
TLS is table stakes, but the operational reality is expired certs, manual renewals, and keys spread across every layer that terminates HTTPS.
Expiry is an outage
A missed renewal takes a site down for every visitor at once, and the failure is total, not partial.
Keys end up everywhere
When every box that terminates TLS holds the private key, your exposure grows with every layer you add.
Rotation is manual and risky
Hand-rolled rotation across domains is error-prone, and teams delay it precisely because it can break production.
What you get
Lifecycle handled, keys held behind a boundary
Certificate management lives in its own boundary, separate from the enforcement layer that inspects requests.
Issuance and renewal
Certificates are provisioned for your domains and renewed on schedule, so expiry stops being something you track by hand.
Rotation by design
Rotation is a routine, reversible operation rather than a manual scramble across each domain.
Custom domains
Bring your own domains and serve HTTPS through ArxLayer Edge without standing up your own termination.
No keys in enforcement
The WAF and bot layers reference each certificate as an opaque value and never resolve it to a private key.
Separate custody boundary
Key custody is its own boundary, so the layer inspecting traffic is not the layer holding secrets.
One control plane
Manage certificates through the same API-first control plane that drives your WAF, bot, and reputation policy.
How it works
From domain to HTTPS, then hands-off
Add a domain, route it through the edge, and let renewal and rotation run on their own.
Add your domain
Bring a custom domain into ArxLayer and point traffic at the edge for termination.
Get a certificate
A certificate is provisioned for the domain so HTTPS is live at the edge, with the key held behind its own boundary.
Stay current automatically
Renewal and rotation run on schedule, and enforcement keeps referencing the certificate as an opaque value throughout.
FAQ
Questions, answered
- Does the WAF store my TLS private keys?
- No. The enforcement layer references each certificate as an opaque value and never resolves it to a private key. Key custody is a separate boundary.
- Are renewals automated?
- Certificate renewal and rotation are designed to run on schedule rather than as manual steps, so expiry stops being something you track by hand.
- Can I use my own custom domains?
- Yes. Bring your own domains, route them through ArxLayer Edge, and serve HTTPS without operating your own TLS termination.
- Why separate certificates from enforcement?
- Keeping key custody out of the request-inspection layer is a cleaner security boundary, so the layer that sees traffic is not the layer that holds secrets.
Make TLS one less thing to watch
Bring your domains to ArxLayer, serve HTTPS at the edge, and let renewal and rotation run while keys stay out of enforcement.