ChatGPT dots + xCloud

Manage SSL and domains with ChatGPT dots on xCloud

Managing SSL and domains with a ChatGPT dot means asking your always-on OpenAI agent to watch certificate expiry and DNS for your xCloud sites, and to install or renew a certificate after your approval.

Skill: xcloud:ssl
Toolsets: ssl-certificates, sites, integrations
Free with every xCloud account

Set up ChatGPT dots All ChatGPT dots guides

YouCheck the certificate on shop.example.com and renew it if it is due.

sites_sslread-only

AgentThe certificate is from xCloud, active, and expires in 4 days, so a renewal is due. Renew it now?

YouYes.

sites_ssl_renewneeds approval

sites_sslread-only

AgentRenewal accepted. I re-read the certificate: the status moved to issued with a later expiry date, and shop.example.com loads over HTTPS.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up ChatGPT dots to Manage SSL and domains on xCloud?

Connect ChatGPT dots once; every job on this account uses the same connection. Then ask in plain words.

1
Create the xCloud MCP plugin in ChatGPT
Plugins are shared across your dot, ChatGPT, ChatGPT Work and Codex, so you set xCloud up once. In ChatGPT on the web, turn on Developer mode under Settings, Security and login, open the Plugins page, select the plus button and create an app named xcloud with this MCP server URL and OAuth as the authentication. Sign in with xCloud, tick the teams and choose Read-only or Full access. Then open your personal Plugins page, open xcloud and select the plus button to install it; until it is installed, your dot cannot see it. If ChatGPT already has the xcloud plugin installed, skip this step. That path is for a personal account. In a Business, Enterprise or Edu workspace the controls sit under Apps instead. On Business only an admin or owner can use Developer mode: they turn it on while creating the app from Workspace settings, Apps, Create, and publish it from Workspace settings, Apps. On Enterprise and Edu an admin or owner can also toggle Developer mode under Settings, Apps, Advanced settings, and a member granted developer access under Permissions and Roles turns it on there too and can create and test the app from their own Settings, Apps, Create, but only an admin or owner can publish it. An ordinary member cannot do this, so ask an admin to publish the xcloud app; then open Settings, Plugins, select xcloud, install it if offered and choose Connect, sign in to xCloud and pick the teams and access level, and only then start at the next step.
URL
```
https://app.xcloud.host/mcp
```
2
Check the plugin is connected for your dot
Open your dot's profile, then Customize and Plugins, and make sure xcloud is connected. The screen uses the shared ChatGPT plugin settings, so a plugin connected in ChatGPT appears here too. Then give your dot a first task that names xCloud.
Prompt
```
Using xcloud, who am I on xCloud, and which servers and sites do I have?
```
3
Add a custom rule for hosting changes
Under Customize, Custom rules, describe the action and choose Ask before taking action. Pre-approved means you asked for the action in your prompt. xCloud stops for confirmation on its own before it creates, deploys, updates, reboots or deletes anything, but a rule keeps the approval visible in your conversation and stops a scheduled task from proposing changes you did not ask for.
Prompt
```
Ask before taking action: anything that creates, deploys, updates, reboots or deletes a server or site on xCloud.
```

Check it worked

Then ask ChatGPT dots for the job itself, for example:

Prompt

Every morning at 7, list the sites whose SSL certificate expires within 30 days and any domain whose DNS no longer points at its xCloud server, and message me. Renew nothing without asking me.

In practice

How Does SSL and domains Work from ChatGPT dots?

Certificates fail quietly, which makes them a good fit for an agent that keeps watch. Ask your dot for a recurring check, for instance every morning at 7, list every site whose certificate expires in the next 30 days and any domain whose DNS no longer points at its server, and message me. It reads sites_ssl and sites_sslCertificates for the provider, the status and the expiry, and servers_dns_check for the record. Each DNS check is one lookup, so for a new domain the dot repeats it while the record propagates, and it flags a Cloudflare-proxied record separately, because on a site managed through Cloudflare the proxy is the finished state and not a fault.

Acting on what it finds is a smaller step with a clear shape. sites_ssl_renew only does anything when the certificate is within seven days of expiry unless you ask for a forced renewal, and install and renew report success before issuance finishes. Your dot therefore polls the certificate status until it settles and fetches the site over HTTPS before it says the job is done. If the site already uses a different provider, it asks before it replaces a working certificate, and for a WordPress site adopting HTTPS for the first time it asks whether to run the database search-and-replace. Those questions arrive as ordinary messages in your conversation, so you can answer them from the ChatGPT mobile app or Slack.

Domains themselves are a read for your dot. It lists the primary and additional domains and the update status, but adding, changing or removing a domain on an existing site is a dashboard step, Site, Domain, and a staging site goes live under Domain, Go Live. When visitors report a Cloudflare 526, tell your dot, and it reads the certificate first. A 522 is a different problem, usually ports 80 and 443 blocked at the origin.

ChatGPT dots specific: Reading certificates works on every plan, but installing or renewing one is a write. OpenAI's help center says full MCP support with write actions is in beta on Business, Enterprise and Edu workspaces, and Pro accounts connect MCP apps with read and fetch permissions only, so on Pro let the dot warn you about an expiring certificate and make the renewal yourself or through another agent. Remember too that a DNS check is a single lookup and a snapshot: ask the dot to check again after a few minutes instead of treating the first answer as final.

What xCloud does for ssl and domains

xCloud lets the agent read a site's certificate status, domains and DNS, then install or renew a certificate from xCloud (Let's Encrypt), your own files or a connected Cloudflare account. Adding or changing a domain on an existing site stays in the dashboard, and the agent gives you the path.

Find the site and read its SSL. The agent resolves the site by name or domain, then reads its current SSL state and the list of certificates before it changes anything. That shows the provider, the status and the expiry date.
Check the domain and DNS. It reads the site's primary and additional domains and asks xCloud whether the domain's DNS record points at the server. Each check is one lookup, so the agent repeats it while a record propagates. A record behind Cloudflare's proxy is reported separately.
Choose the certificate source. You pick xCloud's free Let's Encrypt certificate, your own certificate, or the team's Cloudflare integration. If the site already uses a different provider, the agent tells you that switching needs an explicit override and asks first.
Install or renew, once you approve. The agent restates the site and the provider, then installs or renews the certificate. A renewal only runs when the certificate is within seven days of expiry unless you ask for a forced renewal. For a WordPress site turning on HTTPS for the first time, it asks whether to run the database search-and-replace.
Poll to issuance and verify. Install and renew report success before issuance completes. The agent polls the certificate status until it settles, then checks the site over HTTPS before it calls the job done.
Hand off domain changes. If you want to add, change or remove a domain on an existing site, the agent gives you the dashboard path (Site > Domain) and the site's dashboard link, because the API only reads domains after creation.

Reference

SSL and domains Settings and Limits on xCloud

The facts ChatGPT dots works within when it manages SSL and domains. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Certificate status	A site's SSL state, its certificate list and one certificate's detail and status are all readable
xCloud certificate	Free Let's Encrypt certificate issued and renewed by xCloud. The domain's DNS should already point at the server before you ask
Custom certificate	You supply the PEM certificate and its private key. The key is a secret and is never returned by a read
Cloudflare certificate	Uses the team's connected Cloudflare account. When the zone is connected, xCloud writes the DNS record and the certificate itself at site creation
Switching provider	Needs an explicit force when another provider is already configured, so the agent asks before it replaces a working certificate
Renewal rule	A renewal does nothing unless the certificate is within seven days of expiry; a forced renewal skips that guard. Renewing needs the site SSL permission on your team role
WordPress first HTTPS	An optional database search-and-replace moves existing http:// URLs to https:// when a WordPress site adopts HTTPS for the first time
DNS check	One lookup per call. A proxied Cloudflare record is flagged, and on a Cloudflare-managed site the proxied record is the finished state, not a fault
Domains (read)	The primary domain, additional domains and the domain update status are readable through the API
Domains (write)	Adding, changing or removing a domain on an existing site is dashboard-only: Site > Domain. A staging site goes live under Site > Domain > Go Live
Deleting a certificate	Available through the API, but it can take a site off HTTPS, so the agent restates the target and waits for your approval
Cloudflare 526 errors	A 526 or a certificate warning is an SSL problem, so the agent reads the certificate first. A 522 is different: it usually means ports 80 and 443 are blocked at the origin

Rules ChatGPT dots has to follow

Installing, renewing, switching or deleting a certificate stops for your approval, and the agent names the site and the provider before it asks.
A success response means xCloud accepted the work, not that the certificate was issued: the agent polls the status and checks the live HTTPS URL.
The agent never replaces a working certificate with a different provider without telling you, and it never turns off the Cloudflare proxy on a site xCloud manages through Cloudflare.
Changing a domain on an existing site is a dashboard step; the agent gives you the path and the dashboard link xCloud returned, not a made-up workaround.
A custom certificate's private key is a secret: it is never returned by a read and should not be pasted into a shared channel.

Example prompts

What Can You Ask ChatGPT dots to Do for SSL and domains?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Every morning at 7, list the sites whose SSL certificate expires within 30 days and any domain whose DNS no longer points at its xCloud server, and message me. Renew nothing without asking me.

Prompt

Is the A record for example.com pointing at my Frankfurt server yet? If it is, issue the free xCloud certificate and confirm the site loads over HTTPS. If the Cloudflare proxy is on, say so.

Prompt

Visitors see a Cloudflare 526 error on shop.example.com. Read the certificate first, tell me what is wrong and what you would change, and ask me before you do it.

Prompt

Check the SSL certificate on shop.example.com and tell me when it expires.

Prompt

Is the DNS A record for example.com pointing at my Frankfurt server yet? Tell me if the Cloudflare proxy is on.

Prompt

Issue a free SSL certificate for example.com once DNS resolves, then confirm the site loads over HTTPS.

Prompt

Renew the certificate on the shop site and tell me the new expiry date.

Prompt

List every domain and additional domain on the shop site and say which is primary.

Prompt

Which of my sites have a certificate that expires in the next 30 days?

Prompt

Use my connected Cloudflare account for the certificate on shop.example.com, and show me what will change first.

Prompt

Visitors get a Cloudflare 526 error on shop.example.com. Check the certificate and tell me what is wrong.

ChatGPT dots and SSL and domains: Frequently Asked Questions

What people ask before they let ChatGPT dots manage SSL and domains through xCloud.

Can my ChatGPT dot warn me before an SSL certificate expires?

Yes. Ask for a recurring check, for example every morning list the sites whose certificate expires within 30 days, and the dot reads the certificate status for every site and messages you. Reading needs no approval from xCloud, so this works on any plan that can create a dot.

Can my dot change a site's domain?

No. Adding, changing or removing a domain on an existing site is dashboard-only, under Site, Domain. Your dot can read the domains and run a DNS check, and it gives you the dashboard path and the site's link for the change itself.

Can an AI agent add a domain to an existing site?

No. The API reads a site's domains, additional domains and domain update status, but adding, changing or removing a domain on an existing site is a dashboard step under Site > Domain. A domain is chosen when the site is created. The agent can tell you what is currently set and give you the path.

Which certificate options can the agent install?

Three: xCloud's free Let's Encrypt certificate, a custom certificate you supply, and a certificate through your connected Cloudflare account. The agent checks the current state first and asks before it changes anything. Switching a site from one provider to another needs an explicit override.

Why did the agent say a renewal did nothing?

A normal renewal only fires when the certificate is within seven days of expiry. If you need it earlier, ask for a forced renewal and the agent will confirm before it runs. Renewing also needs the site SSL permission on your team role.

Does the agent set up my DNS records?

It reads and checks them rather than writing them. It can tell you whether a domain's record points at your server and whether the Cloudflare proxy is on. DNS and the certificate are written for you only at site creation, when the domain's zone is on a Cloudflare account you connected to xCloud.

What does the agent do about a Cloudflare 526 error?

It treats it as an SSL problem. It reads the site's certificate status and expiry, and fixes it with an installation or renewal after your approval. A 522 is a different fault, usually closed ports 80 and 443 on the origin, so it is checked against the firewall instead.

Other agents