# HTTPS, DNSSEC and certificates: how RN protects your connection

See how ACM certificates, enclave key operations and signed DNS protect the RN entry point. Understand the scope of each control.

Rota Nacional · 2026-11-02T02:35:00Z · 2026-11-02T02:35:00Z

## HTTPS authenticates the connection

The main RN domain and the platform entry point use AWS Certificate Manager, or ACM, certificates with export disabled. Private-key operations occur in the TLS enclave. TLS is the protocol used by HTTPS.

Nginx uses the operation results to terminate the connection. The core does not depend on an exportable PEM private-key file. After this step, the application still receives the content needed for the task.


## DNSSEC authenticates DNS answers

DNS translates a service name to its address. DNSSEC adds signatures that a validating resolver can check. The signatures need a chain to the root, including a DS record published at the registrar.

RN published its DS record and checked the complete chain for the main domain and platform records. DNSSEC does not encrypt queries or replace HTTPS. Validation also depends on the client's resolver.


## CAA restricts certificate issuers

The core CAA record permits Amazon issuance. It tells certificate authorities which issuers are authorized. Development and staging have specific exceptions for their Let's Encrypt certificates.

Customer domains retain their own certificates and identities. One customer's certificate does not identify another customer. Separate domains do not mean a dedicated machine.


## Monitoring is part of operation

The design includes alerts for DNSSEC, DNS changes and availability. The internal supervisor monitors critical processes and closes admission on a persistent failure. Opening it again requires the owner's action.

These controls reduce different risks. They do not prevent every interruption or authorize data transfer to a model. Account, organization, privacy barrier and consent controls still apply to each integration.


## Frequently asked questions

Does DNSSEC replace HTTPS?

No. DNSSEC permits verification of DNS answer authenticity. HTTPS authenticates and encrypts the connection to the service. The controls have different purposes.

Is all content processed inside the enclave?

No. The TLS enclave protects private-key operations. Nginx terminates HTTPS, and the application processes content needed for the task. Organization policy still determines what can be sent externally.


- [ACM for Nitro Enclaves](https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave-refapp.html)
- [Route 53 DNSSEC](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html)
- [Route 53 CAA records](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#CAAFormat)

[Integrate with the RN API](https://rota-nacional.ia.br/en/docs/)

Use the compatible protected route with the organization's configured policy. You do not need to add the same policy and usage billing to each client.
- [Use with an agent](https://rota-nacional.ia.br/llms.txt)

[HTTPS, DNSSEC and certificates: how RN protects your connection](https://rota-nacional.ia.br/en/articles/ai-api-certificates-dns-security/)