"Automatic HTTPS" is a real feature, but the work it's automating away is worth understanding, because it's a surprising amount of small, easy-to-get-wrong steps.
What getting HTTPS manually actually involves
Install certbot. Run it to request a certificate for your domain, choosing the right challenge type (HTTP-01 needs port 80 reachable; DNS-01 needs API access to your DNS provider). Configure your web server to serve the challenge response. Configure it again to actually use the resulting certificate. Set up a cron job to renew before the (short, 90-day) expiry. Make sure the renewal hook actually reloads your web server, or the renewed certificate sits on disk unused. Repeat all of this for every additional domain.
None of these steps are hard individually. Getting all of them right, for every domain, forever, without a renewal silently failing six months from now, is where it goes wrong in practice — an expired certificate is one of the most common self-inflicted outages in self-hosted setups.
What DeployOS does when you add a domain
When you attach a domain to an app, DeployOS writes the routing configuration for your reverse proxy (Traefik or Caddy) with the cert resolver already configured, and the proxy itself requests the certificate on first request. Renewal is handled by the same proxy process continuously — no cron job, because there's nothing scheduled; it's just always running and always aware of its certificates' expiry.
Domain verification, not just certificate automation
Before that even happens, DeployOS's domain cutover flow checks that your DNS actually points at the server (an A record pointing at the wrong IP is the other extremely common cause of "HTTPS isn't working") and polls until propagation completes, so you get a clear "pointing correctly, certificate issued" signal instead of a silent failure to debug later.
Multiple domains, one proxy, zero incremental config
Because this is all driven by the reverse proxy watching for new routes, adding a second, third, or fiftieth domain doesn't mean fifty separate certbot configurations — it's the same automatic issuance and renewal, per domain, on the same running proxy.
If you want to understand the mechanism directly
The underlying Traefik-based approach (network setup, labels, cert resolver config) is the same pattern covered hands-on in How to Set Up Docker + Traefik on a VPS for Automatic HTTPS — this post is what DeployOS automates end to end so you never have to hand-write it.