How SSL is issued and renewed

Certificates are automatic. What to expect, and what stops one being issued.

Every domain on the platform gets a free certificate, issued automatically and renewed before it expires. There is nothing to buy and nothing to install.

What happens

1. The domain is added to a site

   Validation begins as soon as the domain resolves to us.

2. The domain is validated

   Over HTTP, or over DNS when the zone is hosted here. No action is needed from you either way.

3. The certificate is installed

   Usually within a few minutes. The Domains panel shows Active with the expiry date.

4. It renews automatically

   Thirty days before expiry. A failed renewal raises an alert to us and to you, with time left to fix it.

When issuance fails

• The domain does not resolve to us. Validation cannot complete until DNS is correct.
• A CAA record blocks it. If the domain has a CAA record naming another authority, add letsencrypt.org or remove the record.
• Another proxy is in the way. An external Cloudflare in flexible mode, or a firewall blocking /.well-known/acme-challenge/.
• Rate limits. Repeatedly adding and removing a domain hits the authority's weekly limit. Wait, or ask support to switch the validation method.