SSL and certificates

The padlock in the address bar. A certificate encrypts the traffic between your visitor and your site, and lets the browser prove it is really talking to your domain. For most people the good news is that there is nothing to do here. This p

Written for: Customer, Reseller, Administrator

Screenshot — Panel → Hosting → Accounts → your account → SSL/TLS. At the top is the Certificate for picker: every domain has a certificate of its own. Screenshots are captured with openwolf designqc into .wolf/designqc-captures/.

What happens on its own

Add a domain to your account and the server requests a certificate from Let's Encrypt as soon as the domain points at this server. That usually takes under a minute. After that it is renewed automatically, well before it expires — a certificate is valid for ninety days and is renewed around thirty days before the end.

So there is nothing to do, except one thing: your DNS has to point at this server. As long as your domain still points at your old hosting, Let's Encrypt cannot establish that it is you, and no certificate arrives.

Looking at the status

Under What is there now you see the certificate the web server is currently offering:

Source — automatic (Let's Encrypt) or a certificate you installed yourself.
Issued to — the domain names on it.
Expires — the end date. Inside thirty days that becomes a warning.

corectl ssl list
corectl ssl list | grep yoursite.com

Requesting a certificate yourself

If it went wrong when you added your domain — the DNS pointed nowhere yet, say — simply click Request certificate once it is right.

corectl ssl issue yoursite.com

What happens underneath: the server puts a small file at http://yoursite.com/.well-known/acme-challenge/…, Let's Encrypt fetches it, and if it matches you get your certificate. Which is why your domain has to be reachable on port 80 and must not redirect everything immediately.

Wildcard: one certificate for all your subdomains

If you have many subdomains (shop., blog., customer1., …) you want one certificate covering them all: *.yoursite.com.

That is only possible when the DNS zone of your domain lives on this server, because a wildcard is not proven with a file on your website but with a TXT record in your DNS. The server puts that record down, waits until it is visible, and takes it away again afterwards.

corectl ssl issue yoursite.com --wildcard
corectl ssl issue yoursite.com --no-wildcard   # back to the domain itself only

In the panel this is under Automatic certificate as Subdomains too.

If your DNS lives at your registrar or at Cloudflare a wildcard is not possible from here — request an ordinary certificate per subdomain instead, which works fine.

Renewing

Renewal happens on its own, from a timer on the server. To force it now — because you just added a subdomain, say:

corectl ssl renew yoursite.com    # this one certificate
corectl ssl renew                 # everything that is due

Renewing does not run into limits as long as you do not put it in a loop. Let's Encrypt does count requests per week per domain, so do not keep re-requesting when something fails — fix the cause first.

Installing a certificate of your own

If you bought a certificate elsewhere (an EV certificate, or one from your employer), install it under Install your own certificate. You need three things:

Field	What it is
Certificate	the certificate itself, in PEM — starts with `-----BEGIN CERTIFICATE-----`
Private key	the matching key, in PEM. It leaves your browser only for this server
Intermediates	the issuer's chain, if you were given it separately

Paste them, or choose the files. The panel checks before saving that it really is PEM, that the certificate has not already expired, and that the key belongs to the certificate. When the pair matches you see Checked: this pair belongs together.

corectl ssl install yoursite.com \
  --cert-file  ~/yoursite.crt \
  --key-file   ~/yoursite.key \
  --chain-file ~/intermediates.pem

Note that a certificate of your own is not renewed automatically. Set a reminder yourself; the server warns you thirty days ahead, but it cannot solve it for you. To go back to automatic, simply request a Let's Encrypt certificate again — that overwrites your own.

When it does not work

What you see	What it usually is
No certificate after adding a domain	The DNS does not point at this server yet. Check with `dig +short A yoursite.com`.
"Timeout during connect" on the request	Port 80 is closed, or a firewall in front of your domain blocks it.
Browser: "certificate is not valid for this name"	You are visiting `www.yoursite.com` but the certificate only covers `yoursite.com`. Add the subdomain to the account, or request a wildcard.
Browser: "your connection is not private" after your own certificate	The intermediates are missing. Fill in the third field.
"This key does not belong to this certificate"	You pasted the key of a different request. Use the pair that was created together.
Wildcard fails with "no such zone"	The DNS zone is not on this server. No zone, no wildcard.
Everything looks right but the site stays on `http://`	Your site itself is not redirecting. For WordPress: set the site URL to `https://`.

Checking what the world sees:

echo | openssl s_client -connect yoursite.com:443 -servername yoursite.com 2>/dev/null \
  | openssl x509 -noout -subject -dates