PortaFrom 2029, TLS certificates live just 47 days.
Manual certificate management dies when every certificate expires eight times a year. Porta is the reverse-proxy gateway that renews your certificates automatically over ACME — before they expire, without you ever noticing.
- Docker · Binary · Service
- Linux & Windows
- ACME · RFC 8555
- Let's Encrypt
- DNS-01 / HTTP-01
- YARP engine
The clock is ticking — and it's speeding up.
The CA/Browser Forum (Ballot SC-081v3) is progressively slashing the maximum validity of public TLS certificates: 200 → 100 → 47 days. The reason: the shorter a certificate lives, the smaller the window in which a stolen or mis-issued key can do harm — and the less the web has to rely on sluggish revocation mechanisms like CRL/OCSP. A security win for the whole web — and an operations problem for anyone still renewing by hand.
Browsers and API clients drop the connection with a security warning — the service is effectively offline until a valid certificate is installed. A forgotten renewal stops being an annoyance and becomes an outage.
A gateway that takes care of its own certificates.
Porta combines reverse proxy, automatic TLS renewal and observability in a single process — a drop-in, nginx-compatible replacement.
Automatic ACME renewal
Fully automated issuance and renewal via Let's Encrypt (ACME RFC 8555). Configurable renewal threshold — certificates are renewed long before they expire.
DNS-01 & HTTP-01
Challenge selectable per domain: HTTP-01 over port 80 — works with any DNS host — or DNS-01 over a provider-agnostic interface (IONOS out of the box, more on request). Wildcards included.
Reverse proxy on YARP
Fast, .NET-native proxying. Hostname and path routing, header transforms, WebSockets and X-Forwarded-* handled automatically.
nginx parity
Body limits, timeouts, host preservation, X-Real-IP, backend protocol, user-agent blocking — the nginx directives you know, as clean YAML config.
Adapter-based configuration
Routing and TLS config from a file (YAML), Postgres or SproutDB. Same fields, your choice of source.
Live monitoring
REST and SignalR endpoints for real-time observability. A separate desktop client aggregates state across all your instances.
Audit log
Every operation is persisted to local SQLite — traceable and auditable.
Alerts via ntfy
Push notifications over ntfy.sh on renewal problems or critical events — you find out before your customer calls.
Runs wherever you want
Per server instance, your choice of form: Docker container, native Linux or Windows binary, or system service (systemd / Windows Service). No cluster lock-in, no hidden complexity — same config everywhere.
Fast where it counts. Automated where it hurts.
Porta proxies on YARP — the engine Microsoft builds and runs in production (it powers Azure App Service, Bing, Azure AD and Dynamics 365). In independent load tests a fully tuned nginx leads raw throughput by ~10–20%; both clear tens of thousands of requests per second. On a typical 1 Gbit/s server uplink, the network card gives out long before the proxy does.
Requests/second at 200 concurrent users · p90 latency: nginx 6.34 ms · Porta 7.77 ms.
Source: independent benchmark (Milan Jovanović, 2025).
A standard server link tops out around 125 MB/s. The .NET network stack Porta is built on (Kestrel/YARP) has been measured saturating a 10 GbE link at 7M+ requests/s — ten times that. Your real bottleneck isn't throughput. It's the certificate that expired at 3 a.m.
In production in three steps.
Start Porta
As a Docker container, native binary or system service — your call. Two files, routes.yaml and tls.yaml, define everything in every form.
Add your domains
Specify domain and backend, pick a challenge (DNS-01 / HTTP-01). Porta fetches the certificate automatically on first start.
Forget about it
From there Porta renews every certificate on its own before expiry. No cron job, no calendar reminder, no 3 a.m. emergency.
# One domain + one wildcard, renewed automatically acme: email: ops@example.com defaults: renewal_threshold_days: 30 domains: - name: app.example.com challenge: dns-01 - name: "*.example.com" # wildcard → dns-01 # Start — container, binary or service $ docker compose up -d $ ./porta # native Linux/Windows binary
The sweet spot between OSS and enterprise.
Porta sits deliberately below the enterprise players and above the OSS tools: automated certificates with commercial support — without the enterprise price tag.
| Solution | Per server / year | Auto-TLS | Commercial support |
|---|---|---|---|
| Caddy / Traefik OSS | €0 | Yes | Self-service |
| Porta Solo | €190 | Yes | Yes · 48h |
| Porta Business (at 10 servers) | ~€79 | Yes | Yes · 48h |
| nginx Plus | ~€2,300 | Add-on | Yes |
| nginx Plus + 24/7 SLA | ~€6,900 | Add-on | Yes · SLA |
| HAProxy Enterprise | ~€2,000–5,000 | Add-on | Yes · Custom |
Fair per-server pricing. Every feature included.
Every tier includes the full feature set and all updates. No feature gates. All prices net, excl. VAT.
- 1 Porta instance
- All features & updates
- Email support within 48h
- Up to 10 Porta instances
- All features & updates
- Email support within 48h
- Unlimited Porta instances
- Email support within 24h
- Phone escalation for critical issues
Sales start soon · early access is open — get in touch
Frequently asked questions
Why are TLS certificates getting shorter?+
The CA/Browser Forum's Ballot SC-081v3 progressively shortens the maximum lifetime of publicly trusted TLS certificates: 200 days from March 2026, 100 days from March 2027, and 47 days from March 2029. Shorter lifetimes shrink the window in which a stolen or mis-issued certificate can do damage and reduce reliance on slow revocation — but they make manual renewal impractical.
What happens when a certificate expires?+
Browsers and API clients refuse the connection with a certificate warning. The website or service is effectively unreachable until a valid certificate is installed. At 47-day lifetimes this has to run flawlessly roughly eight times a year, per domain. Porta automates renewal end to end.
How is Porta different from Caddy, Traefik or nginx?+
Porta combines YARP-based reverse proxying with fully automated ACME certificate management, DNS-01 and HTTP-01 challenges per domain, live monitoring, an audit log and alerts. Unlike pure OSS tools it comes with commercial support — without the enterprise price tag of nginx Plus or HAProxy Enterprise.
Is YARP fast enough compared to nginx?+
Yes. Porta's proxy engine is YARP, built and operated by Microsoft (it powers Azure App Service, Bing, Azure AD and Dynamics 365). In independent benchmarks a fully tuned nginx leads raw throughput by roughly 10–20% — but both handle tens of thousands of requests per second, far beyond what a typical server ever needs. For these workloads the bottleneck isn't proxy throughput; it's an expired certificate.
Can Porta saturate a gigabit link?+
Easily. A 1 Gbit/s uplink — the standard server link — peaks at roughly 125 MB/s, and the .NET network stack Porta is built on (Kestrel, which underpins YARP) has been independently measured saturating a 10 GbE link at over 7 million requests per second — ten times a gigabit. On normal server hardware your network card is the ceiling, not Porta.
Does Porta support wildcard certificates?+
Yes. Wildcard domains (*.example.com) are issued and renewed automatically via the DNS-01 challenge. That requires a natively supported DNS provider — IONOS out of the box, more on request. Single domains can also be validated via HTTP-01, with no supported DNS provider at all.
Which DNS providers does Porta support for DNS-01?+
Porta is built on a provider-agnostic DNS abstraction. IONOS is available out of the box; further DNS providers are added on request. For single domains you don't need a supported DNS provider at all — the HTTP-01 challenge works independently of your DNS host. A natively integrated DNS provider is only required for wildcard certificates.
How do you run Porta?+
Porta runs per server instance — as a Docker container, a native Linux or Windows binary, or a system service (systemd / Windows Service). Configuration is identical in every form and comes from a file (routes.yaml + tls.yaml), Postgres or SproutDB. A working example is included.
What does Porta cost and when can I buy?+
Porta is sold as a per-server subscription: Solo from €19/month (€190/year, email support within 48h), Business from €79/month (€790/year, up to 10 instances) and Enterprise at €2,490/year (unlimited). All prices net, excl. VAT. Sales start soon — get notified at launch.
Be ready before the clock hits 47.
Porta is in pre-launch. Get in touch for early access — everyone who joins now gets a head start and special launch terms.
Email office@qsp.app — we'll reach out at launch.