SSL Certificate list
SSL Certificate Management
⚠️ Updated 2026-07-15. Wildcard certs migrated from DigiCert to ZeroSSL DV (ACME / Let's-Encrypt-style, ~90-day), created via Let's Encrypt automation and stored in Ahola Group Vault — https://vault.aholagroup.com/. Current unified process: SSL certificate renewals: Current process (2026).
1. Certificates We Have
Below is a list of SSL certificates currently in use by our company:
| Certificate | Type | Issuer / Source | Expiry | Deployed on |
|---|---|---|---|---|
| *.attracs.com | Wildcard | ZeroSSL DV (ACME) · Vault | 2026-09-17 | 7 GCP LBs · 4 HAProxy frontends · Windows online2 |
| *.aholatransport.com | Wildcard | ZeroSSL DV (ACME) · Vault | 2026-10-04 | GCP LBs only (removed from Hetzner frontends 2026-07) |
| *.aholadigital.com | Wildcard | Let's Encrypt / ZeroSSL · Vault | 2026-09-21 | 10 GCP LBs · Hetzner Cloud LB |
| *.online.aholadigital.com | Wildcard | ZeroSSL DV (ACME) · Vault | 2026-09-19 | Windows RDS (2 gateways + Broker) |
| online2.attracs.com | uses *.attracs.com cert | — | 2026-09-17 | Windows RDS / RDWeb |
| meshmoon | Wildcard | Let's Encrypt (certbot) | — | ⚠️ server no longer ours — do not manage |
| Apple Cert | Google Workspace | — | Google Admin console | |
| Biztalk DVV | Integration cert | DVV | — | Biztalk stable/nightly (Finnish Customs) |
All wildcards are ~90-day now; next renewal round: start ~2026-09-10. ⚠️ attracs-devops-3 (Azure Online-api2) HAProxy is hand-maintained — cert changes are manual, never Ansible-deploy.
2. Servers, Services, and Applications Using Certificates
Maps each certificate to the servers / LBs / services it currently secures. Retired targets are kept but marked NO LONGER USED.
| Certificate | Deployed on | Targets | Notes |
|---|---|---|---|
| *.attracs.com | 7 GCP LBs + 4 HAProxy frontends + Windows | GCP: attracs-services, attracs-nightly-services, attracs-logistics, attracs-logistics-nightly, eazytms, eazytms-nightly, attracs-devops · Frontends: attracs-frontend-1, attracs-frontend-2, tailorframe-2, attracs-devops-3 (Azure "Online-api2") · Windows: online2.attracs.com (broker 10.2.0.5 + gateway 10.2.0.6) | ☢ attracs-devops-3 HAProxy is hand-maintained — manual cert change, never Ansible-deploy |
| *.aholatransport.com | GCP LBs only | stable attracs-services-195009, nightly att-nightly |
GCP-LB-only since 2026-07 (removed from Hetzner frontends) |
| *.aholadigital.com | 10 GCP LBs + Hetzner Cloud LB | GCP: common-servers-01, stable-servers-01, nightly-servers-01, stable-biztalk-01, nightly-biztalk-01, attracs-devops, attracs-logistics, attracs-logistics-nightly-6519, adi-eazytms-stable, adi-eazytms-nightly · Hetzner Cloud LB (console project 2477407) | attracs-devops / attracs-logistics(-nightly) / eazytms LBs are SHARED with *.attracs.com — keep both certs on swap |
| *.online.aholadigital.com | Windows RDS (GCP RDP env) | RD gateways rdsgw-01 (10.170.0.59), rdsgw-02 (10.170.0.60); Broker 10.170.0.64 (Edit Deployment Properties → Certificates) | session hosts rdshost-0..4 keep internal per-host certs |
| Apple Cert | Google Workspace | Apple devices | Renew in Google Admin console |
| Biztalk DVV | Windows Biztalk | stable-biztalk-01, nightly-biztalk-01 | DVV cert — Finnish Customs integration |
⚠️ Retired / NO LONGER USED (do not update):
* attracs-meshmoon-1 (135.181.3.243) — meshmoon server, no longer ours
* attracs-devops-2 (172.31.1.100) — old online-api-1, shut down / unreachable
* wac.attracs.com — no longer in use
* Hetzner HAProxy frontends for *.aholatransport.com — removed 2026-07 (moved to GCP-LB-only)
* meshmoon cert (certbot on meshmoon) — server not ours
3. How to Update Certificates
Current unified process — start here: SSL certificate renewals: Current process (2026)
*.online.aholadigital.com
SSL certificate renewals: *.online.aholadigital.com (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-261935)
*.online2.attracs.com
SSL certificate renewals: online2.attracs.com (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-206381)
*.aholadigital.com
SSL certificate renewals: *.aholadigital.com (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-261195)
*.attracs.com
SSL certificate renewals: attracs.com (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-11726) SSL certificate renewals: Updating certificates attracs/ahola in Hetzner (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-10823)
*.aholatransport.com
SSL certificate renewals: aholatransport.com (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-216508)
*.meshmoon.com
SSL certificate renewals: Meshmoon (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-10816)
Google workspace Apple cert
Renew apple cert in Google Admin console (https://app.clickup.com/2496230/docs/2c5q6-69975/2c5q6-235595)
Biztalk DVV certifivate
Certificates (https://app.clickup.com/2496230/docs/2c5q6-30781/2c5q6-200641)