Skip to main content
A site with no certificate is served over plain HTTP. A site with one is served over HTTPS, and plain HTTP is redirected to it.

​
Requesting from Let’s Encrypt

Let’s Encrypt checks each name over HTTP before it issues, so every name has to point at this server already. That means the primary domain and every alias — the request covers all of them and fails if any one of them does not resolve here. You are asked for an email address. It is where Let’s Encrypt writes if a renewal starts failing, so it should be somewhere a person reads.

​
Renewal

Shipways reissues Let’s Encrypt certificates when they are within 30 days of expiry, and tries twice a day. A certbot that decides a certificate is not due yet does nothing, so repeating it costs nothing — and a renewal that failed this morning because a name stopped resolving gets another go this afternoon. Thirty days leaves a fortnight of failed attempts to notice and act on before anything stops working. An alert opens when a certificate is within 14 days of expiry, which is the point at which renewal has been due for a while and has not happened. Between thirty and fourteen days out, renewal being due is not news.

​
Pasting your own

For a certificate you bought, or a wildcard issued somewhere else. Include any intermediate certificates in the same box, or browsers will not trust it. This is the single most common reason a pasted certificate works in curl and fails in Safari. Shipways keeps the only copy of the private key and writes it out again whenever the server is rebuilt. Renewing a custom certificate is up to you — nothing here will do it, and nothing here will warn you differently from a Let’s Encrypt one.

​
More than one certificate

A site can hold several and serve one. The rest sit inactive, which is how you stage a replacement: install the new one, check it, then make it the one in use. Removing the active certificate puts the site back on plain HTTP until another is installed.

​
When a request fails

The row keeps the error. The usual causes, in the order they happen:
  1. A name in the request does not resolve to this server.
  2. A name resolves to a proxy in front of the server, so the HTTP challenge never reaches it.
  3. Let’s Encrypt’s rate limits, after several failed attempts at the same set of names in a week.