Cluster nodes talk to each other over a private mesh with mutual TLS. Public product names use Let’s Encrypt. Those are different trust domains on purpose.

Two certificate stories

  • Node mTLS — cluster fabric, control plane, and inter-node service traffic stay on internal certificates.
  • Public TLS — names such as aeolus.cloudbsd.org and blog.aeolus.cloudbsd.ai present Let’s Encrypt certificates to the internet.
  • No mix-up — browsers never see mesh certs; mesh peers never rely on public LE for node identity.

What operators should check

When something fails to connect across nodes, ask which plane you are on: public edge or mesh. Rotate and renew each plane on its own schedule.

Architecture Docs