TLS Certificates

Included with Managed DNS: up to 10 certificates per domain, with wildcards and automatic renewal. Not available for Dynamic DNS hostnames.

1. What This Feature Does

TLS Certificates issues free certificates from Let's Encrypt for names in your Managed DNS domains — the certificates that put HTTPS on a website or secure a mail or application server. Because CertaDNS already answers DNS for the domain, it proves control of each name to Let's Encrypt by publishing a temporary DNS record itself. You do not need a web server running, or any port open.

When a certificate is issued you download the certificate chain and its private key and install them on your server. Private keys are stored encrypted.

2. When You Should Use It

• A server that is not reachable from the internet, or cannot answer on port 80, needs a publicly trusted certificate.
• You want a wildcard certificate (*.example.com), which can only be validated through DNS.
• You want one certificate covering several names in the same domain.

3. When You Should Not Use It

• Your server or hosting provider already obtains certificates for itself. A certificate it renews on its own is less work than one you download and reinstall.
• The domain's DNS is hosted elsewhere, including domains added only for Email Authentication. Issuance needs CertaDNS to answer for the domain.
• You need an organisation-validated or extended-validation certificate. Let's Encrypt issues domain-validated certificates only.

4. Prerequisites

• The domain on Managed DNS and delegated to CertaDNS (status Live). See Managed DNS.
• Fewer than 10 certificates already on that domain. Without any Managed DNS domain, the page shows a prompt to add Managed DNS instead of the list.
• If the domain publishes CAA records, they must allow letsencrypt.org — in an issuewild record too, if you have one and want a wildcard.
• The domain owned by your own account. Certificates are requested per account.

5. How It Works (Brief)

1. CertaDNS generates a new private key (RSA 2048-bit) and asks Let's Encrypt for a certificate covering the names you entered.
2. For each name, CertaDNS publishes a _acme-challenge TXT record in your domain, waits for the CertaDNS nameservers to serve it, and asks Let's Encrypt to check. The record is removed afterwards.
3. When every name is validated, the certificate is issued and the key is stored encrypted.

This usually takes a few minutes, longer with several names. The page updates itself while it runs.

6. How to Use It

Everything below is in Domain tools > TLS Certificates.

Request a certificate

1. Click New Certificate.
2. In the first Domain list, choose the Managed DNS domain.
3. In the second Domain field, enter the name the certificate is for — the domain itself, such as example.com, or a name under it, such as www.example.com.
4. Optionally, in Additional Domains (SANs), enter more names in the same domain, separated by commas.
5. Tick Wildcard certificate (*.domain.com) to cover every name one level under the name you entered, as well as the name itself.
6. Leave Enable automatic renewal ticked or clear it.
7. Click Request Certificate. The certificate appears as PENDING, then VALIDATING, then ISSUED or FAILED. You do not need to refresh the page.

Download and install

1. On a certificate that has been issued and has not expired, click the download icon.
2. Copy or Download the Certificate Chain (PEM) (saved as <name>.crt) and the Private Key (PEM) (saved as <name>.key).
3. Install both on your server and reload it. Keep the private key secret.

Renew a certificate

1. Click the renew icon on an ISSUED, FAILED or EXPIRED certificate, and confirm with Renew.
2. When it shows ISSUED again with a new expiry date, download both files again and install them. Each issuance has a new private key, so the new certificate does not work with the old key.

While a renewal is running, or if it fails, the current certificate can still be downloaded until it expires.

Turn the auto-renew setting on or off

Click the padlock icon on the certificate. The row shows Auto-renew or Manual. Whatever the setting, keep an eye on the expiry date and use Renew when it is close; after any renewal you still need to download and install the new files.

Delete a certificate

Click the delete icon and confirm with Delete certificate. This removes the certificate and its key from CertaDNS. It does not revoke the certificate, and copies already installed on your servers carry on working until they expire.

7. Inputs and Settings

8. Outputs and Results

• The summary shows Certificates used and allowed (10 for each Managed DNS domain).
• Each certificate shows its name, a star and WILDCARD for wildcards, its status, its expiry date with days remaining, and Auto-renew or Manual.
• A failed certificate shows the reason under its name.

9. How to Interpret Results

• Expiry date in yellow — 30 days or fewer left. Renew, then install the new files.
• "Expired … days ago" in red — the certificate is no longer valid, even though its status still reads ISSUED. Renew it.
• Auto-renew on a row is the setting, not a record of a renewal. The expiry date is what tells you whether a certificate has been renewed.

10. Common Issues and Explanations

"… is set up for email authentication only. Certificate issuance validates over DNS, so it needs Managed DNS on the domain."

The domain list includes domains added under Email Authentication. Only Managed DNS domains can have certificates.

"Domain … is not under zone …"

The name you entered is not in the domain you chose from the list.

"Certificate already exists for …"

That name already has a certificate that is pending, validating or issued. Renew it instead, or delete it first.

"… already has 10 certificates, the most a domain can have."

Each Managed DNS domain can have 10 certificates. Failed ones count; expired and revoked ones do not. Delete those you no longer need, or put several names on one certificate.

Status FAILED with "Authorization failed for …"

Let's Encrypt could not confirm the challenge record. The usual causes:

• The domain is not delegated to CertaDNS yet — its status is not Live.
• A CAA record in the domain does not allow letsencrypt.org.
• An additional name is not in the chosen domain.

Fix the cause, then click Renew on the failed certificate.

Status FAILED mentioning too many certificates

Let's Encrypt limits how often it issues a certificate for exactly the same set of names. Wait, or change the names, and try again.

My server shows the old certificate after renewal

Renewing replaces the certificate in CertaDNS, not on your server. Download and install the new certificate and key, and reload the server.

11. Limits and Constraints

• Issuer: Let's Encrypt. Domain-validated certificates only.
• Key: RSA 2048-bit, new for every issuance.
• Names: all in one Managed DNS domain.
• Revocation: not available from the dashboard.

12. Related Features

• Managed DNS — the domain must be live on CertaDNS.
• DNS Records — CAA records that decide which authorities may issue for your domain.

13. Updates and Behavior Changes

• 30 September 2026. The page is now called TLS Certificates. Issuance was repaired this week and the certificates page now updates itself while a certificate is being issued. Private keys are stored encrypted. This article no longer describes a revoke option (the dashboard has none) or automatic renewal: use the expiry date and Renew.
• 1 October 2026. A certificate past its expiry date now shows EXPIRED, and can be renewed. The current certificate stays downloadable while a renewal runs. Every name on a certificate must be in the chosen domain; one that is not is refused when you request it. Only Managed DNS domains are offered in the list.
• 1 October 2026. Certificates now come with Managed DNS alone: 10 per Managed DNS domain, with wildcards and automatic renewal, whatever your Dynamic DNS plan. Dynamic DNS hostnames are not eligible.