The Vault

What it is

The Vault issues and renews certificates for each zone, enforces modern cipher suites, and stores private keys outside the tenant control plane.

Cloudflare analogue: Cloudflare SSL/TLS. SLA 99.99% · p99 20ms. Admins set cipher policy. Private keys stay in The Vault.

• ▸Auto-renewal
• ▸Custom certificates
• ▸HSTS helpers
• ▸Key isolation

How it works

The Vault issues and renews certificates for each hostname. Private keys never leave the vault.

Minimum TLS, HSTS, OCSP stapling, and custom certificates are Policy toggles.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Vault. Automatic HTTPS is on. Upload a custom cert only if you must bring your own.

API

Control-plane: PATCH /api/v1/services/vault. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/services/vault \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/services/vault", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

TLS 1.3 only is fine for modern apps. Keep 1.2 if you still have old POS terminals.

• ▸SOC 2
• ▸PCI-ready
• ▸TLS 1.2+

Runbook

Automatic HTTPS is the default. A custom certificate replaces the issued leaf.