Domains and HTTPS certificates

The two things people do right after installing: point their own domain at it and turn on HTTPS. After that come multiple domains and wildcard certificates for sub-stores.

Sub-stores (subdomains) need a wildcard certificate, which is issued differently from a normal one. Jump straight to wildcard certificates.

1. Point a domain at the server

Step 1: DNS

At your registrar (Cloudflare, Alibaba Cloud, Namecheap, etc.) add:

Type	Host	Value
A	@	your server IP
A	www	your server IP

@ is the bare domain (abc.com), www is www.abc.com. Add both so either address works.

DNS usually propagates within minutes. Check with:

ping abc.com

Seeing your server IP is enough (many servers block ping, so no reply is fine).

Step 2: Bind it on the server

DNS alone is not enough. The web server also has to accept the domain, otherwise the request lands on the default site or errors out.

BaoTa panel: Website → your site → Domain management → add abc.com and www.abc.com.

Docker: nothing to bind. The image ships its own nginx, so the site answers as soon as DNS points here, and the certificate is issued inside the container — see HTTPS with Docker.

2. Get an HTTPS certificate

With BaoTa (easiest)

Website → your site → SSL → choose Let's Encrypt → tick the domains → apply.

Once issued, turn on "Force HTTPS" — otherwise http:// still works and browsers will not redirect.

Certificates last 90 days and BaoTa renews them automatically.

When issuing fails

Let's Encrypt verifies by fetching http://your-domain/.well-known/acme-challenge/xxx. If that fails, nothing is issued:

Symptom	Cause
Verification failed / 404	The domain does not resolve to this server yet, or DNS has not propagated
Connection timed out	Port 80 is closed — open it in your cloud provider's security group
Fails once a CDN is in front	Disable the CDN, issue, then re-enable; or switch to DNS validation
Keeps failing after several attempts	Let's Encrypt rate limits — wait an hour

The rewrite rules that ship with the program already allow .well-known, so they will not block validation. If you customised them, keep that exception — see rewrite rules.

3. HTTPS with Docker

The image already contains nginx and certbot, so the certificate is issued inside the container — no control panel and no separate reverse proxy.

Map both ports:

docker run -d --name faka -p 80:80 -p 443:443 -v acg_data:/data --restart unless-stopped ghcr.io/lizhipay/acg-faka:latest

Issue the certificate in one command (use your own domain and email):

docker exec faka acg-ssl shop.abc.com [email protected]

Add automatic renewal, on the host:

(crontab -l 2>/dev/null; echo "0 3 * * * docker exec faka acg-ssl-renew") | crontab -

The certificate and nginx configuration live in the data volume, so swapping the image or recreating the container keeps them. Full walkthrough and troubleshooting in Install with Docker.

Only when port 80 is already taken by another site do you need a reverse proxy in front. In that case do not run acg-ssl — let the proxy layer manage certificates.

Already have a certificate (a Cloudflare origin cert, or a commercial one)? Install it directly with acg-ssl-import — no Let's Encrypt request needed, and wildcards are supported. See Install with Docker.

4. Multiple domains on one site

Common when you move to a new domain but keep the old one, or run a main domain plus a short one.

First, for either deployment: point every domain at the same server IP in DNS.

Docker: one command. List the domains, put the email last, and they all go onto a single certificate:

docker exec faka acg-ssl abc.com www.abc.com shop.abc.com [email protected]

To add a domain later, re-run it with every domain listed — anything you leave out drops off the certificate. And if even one domain does not resolve here, the whole certificate fails. Details in Install with Docker.

BaoTa:

1. Website → site settings → Domain management → add all of them
2. When issuing the certificate, tick every domain — one certificate can cover several, and any domain you miss will show a certificate error

Redirecting extra domains to the main one

Serving the same site on several domains splits your SEO weight, so people usually 301 the secondary ones. Add this at the top of the rewrite rules:

if ($host != 'abc.com') {
    return 301 https://abc.com$request_uri;
}

Do not add this if you use sub-stores — it would redirect every sub-store domain back to the main site.

5. Wildcard certificates (required for sub-stores)

Once sub-stores are enabled, merchant shops live at xxx.abc.com. Those subdomains are created dynamically and are not known in advance, so a normal certificate cannot cover them — you need a wildcard certificate for *.abc.com.

How it differs

Normal certificates are validated over HTTP (fetching /.well-known/...). Wildcard certificates can only be validated over DNS — you add a TXT record to prove you own the domain.

Issuing one in BaoTa

Website → site → SSL → Let's Encrypt → set the validation method to DNS:

• If your domain is with a supported provider, BaoTa can add the TXT record through the provider's API and renew automatically — strongly preferred
• In manual mode you add the TXT record yourself, but you must redo it every 90 days, and forgetting means the whole site's certificate expires

Issue both names together:

abc.com
*.abc.com

*.abc.com does not include abc.com itself. Issue both, or the main site will show a certificate error.

Sub-store checklist

When a subdomain will not load, check these in order — all four are required:

#	Check
1	Main domain and DNS CNAME are set under Site settings → Other
2	A wildcard * DNS record points at the server IP
3	*.abc.com is bound on the server (add it in BaoTa's domain management) — the one people miss
4	A wildcard certificate for *.abc.com has been issued

See sub-stores for the rest.

6. Troubleshooting

Browser says "not secure" or shows a certificate error The domain you opened is not covered by the certificate. Check whether it was ticked when issuing; subdomains need a wildcard certificate.

Certificate installed but http:// still works Docker: acg-ssl turns the redirect on for you, so if http still answers then the certificate did not go through or nginx was not reloaded — run it again. BaoTa: turn on "Force HTTPS" at the top right of the SSL page.

Site will not load or redirects endlessly after enabling Force HTTPS The CDN or proxy origin protocol conflicts with the redirect: the CDN fetches over http, the site forces https, and the loop never ends. Either set the CDN to fetch over HTTPS, or drop the redirect on this side and let the CDN do it — on Docker that is docker exec faka acg-ssl your-domain [email protected] --no-redirect, in BaoTa turn off "Force HTTPS".

Images and styles break after changing the domain The site domain in the admin panel is still the old one. Update it under Site settings, then clear the template cache by deleting the contents of runtime/view/compile.

Payment callbacks fail The callback URL configured at the payment provider still points at the old domain. A CDN firewall can also block callbacks — see the custom payment callback domain in site settings.