HTTPS, DNSSEC and certificates: how RN protects your connection
See how ACM certificates, enclave key operations and signed DNS protect the RN entry point. Understand the scope of each control.
Rota Nacional · Published · Reviewed
HTTPS authenticates the connection
The main RN domain and the platform entry point use AWS Certificate Manager, or ACM, certificates with export disabled. Private-key operations occur in the TLS enclave. TLS is the protocol used by HTTPS.
Nginx uses the operation results to terminate the connection. The core does not depend on an exportable PEM private-key file. After this step, the application still receives the content needed for the task.
DNSSEC authenticates DNS answers
DNS translates a service name to its address. DNSSEC adds signatures that a validating resolver can check. The signatures need a chain to the root, including a DS record published at the registrar.
RN published its DS record and checked the complete chain for the main domain and platform records. DNSSEC does not encrypt queries or replace HTTPS. Validation also depends on the client's resolver.
CAA restricts certificate issuers
The core CAA record permits Amazon issuance. It tells certificate authorities which issuers are authorized. Development and staging have specific exceptions for their Let's Encrypt certificates.
Customer domains retain their own certificates and identities. One customer's certificate does not identify another customer. Separate domains do not mean a dedicated machine.
Monitoring is part of operation
The design includes alerts for DNSSEC, DNS changes and availability. The internal supervisor monitors critical processes and closes admission on a persistent failure. Opening it again requires the owner's action.
These controls reduce different risks. They do not prevent every interruption or authorize data transfer to a model. Account, organization, privacy barrier and consent controls still apply to each integration.
Frequently asked questions
Does DNSSEC replace HTTPS?
No. DNSSEC permits verification of DNS answer authenticity. HTTPS authenticates and encrypts the connection to the service. The controls have different purposes.
Is all content processed inside the enclave?
No. The TLS enclave protects private-key operations. Nginx terminates HTTPS, and the application processes content needed for the task. Organization policy still determines what can be sent externally.
Keep reading
AI platform encryption and backups: what to check
Understand encrypted disks, KMS and backup recovery in RN. Separate protection at rest from permission to use data.
How RN protects AI API keys with KMS and Nitro Enclaves
See how Rota Nacional separates its application, vault, certificates and encrypted disk. Understand the limits of these controls.
An AI API on your organization's own domain
Understand RN white label inference domains: branding, domain checks, HTTPS and binding to organization keys.