Automate Certificates documentation
Issue and renew a certificate
Automate Certificates requests certificates from Let's Encrypt through ACME v2. This page follows one certificate from request to renewal.
Request a certificate
- Make sure an ACME account is registered in Settings.
- On the Certificates page, request a certificate and enter one or more domain names.
- Choose the key type:
ECDSA-P256(the default),ECDSA-P384,RSA-2048orRSA-4096. - Choose the challenge type:
dns-01(the default) orhttp-01.
A wildcard name such as *.example.com can only be validated with DNS-01. To keep your own private key, send a PEM certificate signing request through the API; its domains must match the request.
DNS-01 challenges
For DNS-01 the certificate stays in the issuing state and the page shows the TXT records to publish. Publish them within 24 hours. The records are checked every 5 minutes, and issuance finishes on its own once they are visible. The app does not write DNS records for you in the web app. Auto-solving through the Cloudflare API exists only in the API and needs Cloudflare credentials; without them the call returns an error with a hint.
HTTP-01 challenges
For HTTP-01 the app serves the challenge answer itself, and an HTTP-01 renewal needs no action from you.
Renewal
- A scheduled job starts each renewal 30 days before expiry.
- An HTTP-01 renewal completes on its own.
- A DNS-01 renewal needs new TXT records every time. The workspace admins get them by e-mail and on the Alerts page, and a webhook event is sent.
- A failed renewal is retried once a day. Each failure raises an alert and a webhook event with its reason, and is recorded in the audit log.
Deploy a renewed certificate
Deploy by hand with Deploy on the Certificates page. To deploy every renewal automatically, create a rule or schedule through the API (POST /v1/automation/rules). Each run shows under Deployments.
Import, revoke and export
You can import an existing certificate, revoke one at the CA, and export a certificate as PEM or PFX. Exporting a private key needs an admin, and it is written to the audit log.