/
Domain and TLS Planning

Domain and TLS Planning

Domain and TLS Planning

Plan hostnames, DNS, and certificates before Order Portal, CCC, and customer email links go live.

Part of platform onboarding: On Boarding Steps (Prime Platform)

Credentials, internal-only endpoints, and customer-specific values belong in your project runbook — not in this public wiki.

1. Hostnames to decide

Endpoint

Typical hostname

Example

Endpoint

Typical hostname

Example

Admin / staff UI

crm. or admin.

crm.example-isp.de

Customer shop (Order Portal)

shop. or bestellen.

shop.example-isp.de

Customer self-care (CCC)

portal. or kunden.

portal.example-isp.de

API (if exposed)

api.

api.example-isp.de

Staging

separate sub-domain

staging-crm.example-isp.de

Decide: production + staging hostname list; document in your delivery runbook.

2. Who does what

Task

Typical owner (managed cloud)

Typical owner (self-hosted / on-prem)

Task

Typical owner (managed cloud)

Typical owner (self-hosted / on-prem)

Register domain

Customer

Customer

Create DNS A/AAAA/CNAME records

Customer IT or NMS on request

Customer IT

Obtain TLS certificate

NMS (managed) or customer

Customer IT

Install certificate on web server

NMS (managed)

Customer IT / NMS support

Set NMS Prime base URLs / trusted proxies

NMS delivery

Customer IT + NMS delivery

Validate redirects & email links

Joint UAT

Joint UAT

Decide:

Who owns the registrar account
Who creates/changes DNS records (name + backup contact)
Who renews TLS certificates
Lead time for DNS changes (often 24–48 h)

3. TLS certificates

  • Use publicly trusted certificates for internet-facing endpoints (TLS Certificates)

  • Automate renewal (e.g. ACME / Let's Encrypt) where possible

  • Separate certificates per hostname or SAN cert — agree with your security policy

  • After install, change default credentials immediately (Login)

4. Configuration checklist

  1. DNS points to correct IP / load balancer

  2. TLS valid for all customer-facing hosts

  3. Apache vhosts / package templates updated for your domains

  4. Application APP_URL and portal URLs match production hostnames

  5. Trusted proxy headers if behind load balancer (Network and Security Boundaries)

  6. Test: admin login, shop, CCC, password-reset email links, API callback URLs

Related