Domain & TLS Certificate ConfigurationCopy Anchor Link

The MCM Platform supports configuring custom domain names (FQDN) and securing network ingress with valid SSL/TLS certificates. Administrators can manage Domain & TLS settings through the MCM Console or with the mcm command-line tool.

Method 1: UI-Based Domain & TLS Configuration (Recommended)Copy Anchor Link

MSP administrators can configure domain and TLS certificate settings directly from the Web Console:

Steps to Update Domain & SSL Certificate:Copy Anchor Link

1. Navigate to Settings: Log in to the MCM Web Console as an MSP Owner or MSP Admin and go to Settings > Domain & TLS.
2. Enter Domain Name: In the Domain Name field, enter your target FQDN (e.g., mcm.yourdomain.com).

   Note: Ensure a DNS A record for this domain points to the server's public IP address before applying.

3. Select SSL Certificate Source:
   • Upload Custom Certificate: Select this option and upload your SSL Certificate file (.crt / .pem) and Private Key file (.key).
   • Let's Encrypt (Free): Select this option and enter your Notification Email Address for expiration alerts.
4. Apply Configuration: Click Apply Domain & SSL Configuration.
5. Confirm Update: In the confirmation modal, click Proceed with SSL Update.

   Warning: Expect ~3 to 5 minutes of temporary maintenance downtime while network gateway services reload.

6. Monitor Progress: Wait for the background process to complete (VALIDATING -> WRITING_CERTS / ISSUING_LETSENCRYPT -> RELOADING_GATEWAY -> COMPLETED).

Method 2: CLI-Based Configuration (Advanced / Automated Scripting)Copy Anchor Link

For automated server provisioning or headless environments, system administrators can configure the domain and TLS certificate from the host server command line with the mcm tool. It performs the same steps as the UI — validation, certificate installation and a live gateway reload — and keeps your domain and certificates in place across upgrades.

Run these commands on the server (on VM1, the Access Node, for a 3-Tier deployment). Before you start, make sure a DNS A record for your domain points to the server's public IP address.

1. Configure a Domain with Your Own CA-Signed CertificateCopy Anchor Link

sudo mcm tls configure \
  --domain=mcm.example.com \
  --cert-type=custom \
  --cert-file=/path/to/your_certificate.crt \
  --key-file=/path/to/your_private_key.key

The certificate must be a PEM file that is valid for the domain you enter; the command rejects a certificate issued for a different name.

2. Configure a Domain with Let's EncryptCopy Anchor Link

sudo mcm tls configure \
  --domain=mcm.example.com \
  --cert-type=letsencrypt \
  --email=admin@example.com

Port 80 must be reachable from the internet and the domain must resolve to this server, so that Let's Encrypt can validate it.

3. Check the Current Domain and CertificateCopy Anchor Link

mcm tls status

This shows the active domain, the certificate issuer and expiry date, and the progress of any TLS change that is currently running.

Default CertificateCopy Anchor Link

Until you configure a domain, MCM serves HTTPS with an automatically generated self-signed certificate for the server's IP address, so browsers show a certificate warning. Configure a domain and certificate using either method above to remove the warning.