# Security & Best Practices


le-cert-server is designed with security as a priority:

- **Centralized Credentials**: DNS provider credentials are stored only on the Certificate Server, not on client nodes
- **Flexible Authentication**: Simple PSK for most use cases, or JWT/OIDC for advanced scenarios
- **HTTPS API**: All communication is encrypted with TLS
- **Audit Trail**: All certificate requests and renewals are logged
- **Least Privilege**: Client nodes only need API access, not DNS provider credentials

## Security Checklist

- ✅ Use strong, randomly-generated API keys (PSK) or JWT authentication
- ✅ Deploy le-cert-server on a trusted, isolated network segment
- ✅ Use production Let's Encrypt (not staging) only after testing
- ✅ Protect the config file with appropriate file permissions (600 or 640)
- ✅ Use a dedicated service account for the le-cert-server process
- ✅ Enable firewall rules to restrict API access to known client IPs if possible
- ✅ Regularly backup the SQLite database to preserve certificate cache
- ✅ Monitor logs for unauthorized access attempts
- ✅ Rotate API keys periodically
- ✅ Use TLS certificates for the server (can be self-signed for internal use)