> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shipways.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificates

> HTTPS, renewal, and what happens when it stops working.

A site with no certificate is served over plain HTTP. A site with one is served
over HTTPS, and plain HTTP is redirected to it.

## Requesting from Let's Encrypt

Let's Encrypt checks each name over HTTP before it issues, so **every name has
to point at this server already**. That means the primary domain and every
[alias](/sites/domains#aliases) — the request covers all of them and fails if
any one of them does not resolve here.

You are asked for an email address. It is where Let's Encrypt writes if a
renewal starts failing, so it should be somewhere a person reads.

## Renewal

Shipways reissues Let's Encrypt certificates when they are within **30 days**
of expiry, and tries twice a day. A certbot that decides a certificate is not
due yet does nothing, so repeating it costs nothing — and a renewal that failed
this morning because a name stopped resolving gets another go this afternoon.

Thirty days leaves a fortnight of failed attempts to notice and act on before
anything stops working.

An alert opens when a certificate is within **14 days** of expiry, which is the
point at which renewal has been due for a while and has not happened. Between
thirty and fourteen days out, renewal being due is not news.

## Pasting your own

For a certificate you bought, or a wildcard issued somewhere else.

Include any **intermediate certificates** in the same box, or browsers will not
trust it. This is the single most common reason a pasted certificate works in
`curl` and fails in Safari.

Shipways keeps the only copy of the private key and writes it out again
whenever the server is rebuilt. Renewing a custom certificate is up to you —
nothing here will do it, and nothing here will warn you differently from a
Let's Encrypt one.

## More than one certificate

A site can hold several and serve one. The rest sit inactive, which is how you
stage a replacement: install the new one, check it, then make it the one in
use.

Removing the active certificate puts the site back on plain HTTP until another
is installed.

## When a request fails

The row keeps the error. The usual causes, in the order they happen:

1. A name in the request does not resolve to this server.
2. A name resolves to a proxy in front of the server, so the HTTP challenge
   never reaches it.
3. Let's Encrypt's rate limits, after several failed attempts at the same set
   of names in a week.