Certificates

1. Point the name at one of your load balancers in DNS and wait for that to be true everywhere.
2. Check port 80 is open from the internet and the site answers on it.
3. Certificates, then Get one from Let's Encrypt.
4. Type the domain. Add more names if one certificate should cover several.
5. Press Request and wait about thirty seconds.
6. Open the site, choose the certificate, turn on https and Force https, then apply.

Settings, Certificates, untick Use the staging service, save, then issue the certificate again. The staging certificate is replaced and nothing else needs changing.

Staging is on by default because the real service allows five certificates a week for the same names, with no way to appeal, and everybody gets the setup wrong at least once.

Renewal needs the name to point at one of your nodes and port 80 to be reachable from the internet. Two causes cover nearly all of these:

• A firewall closing port 80.
• Somebody turned off Listen on http for the site because everything is on https anyway. Turn it back on. Force https already means no real visitor stays there.

The certificate list shows the failure and the reason, and it keeps trying, so one bad night does not become an outage a month later.

A wildcard needs dns-01 validation, which means the authority asks you to put a record in your DNS rather than serve a file.

1. Settings, Certificates, choose your DNS provider and put in the credentials. They are stored encrypted and never shown again.
2. Ask for a certificate covering *.example.com.
3. Choose dns as the validation method.

Add the bare domain as a second name if you want it covered, because a wildcard does not cover the apex.

Certificates, then Upload one. Paste the certificate, with any intermediates below it, and the matching private key.

The key is checked against the certificate before anything is saved, which catches the most common mistake at the point of pasting rather than when a site stops working. Intermediates are put in the right order for you.

Certificates, then Make a signing request. Choose 2048 or 4096 bits. Both are fine: 2048 is faster and 4096 is what some auditors ask for.

You get a block of text to send to your supplier. The private key is made here and stays here, which is the point of doing it this way. When the certificate comes back, find the request in the list and press Paste Certificate.

Get three things from your supplier, usually on a page called ACME or automation: the directory URL, a key identifier (EAB KID), and an HMAC key.

1. Security, Paid Authorities, Add an authority.
2. Name it, paste the directory URL, the key identifier and the HMAC key.
3. Save, then press Test. That registers with the supplier and asks nothing else of them, so it is free and safe.

After that, asking it for a certificate is the same as asking Let's Encrypt, with one extra choice of who to ask.

Certificates, then Make a self signed one. Every browser shows a warning for these, because nothing has vouched for them. Fine for testing and for something only your own systems talk to. Never on a site the public visits.

At every renewal the name is looked up against public DNS and compared with what each node reports its own public address to be. The node that matches is the one that runs certbot, because it is the only one the authority can reach.

The challenge token goes to every node before validation starts, because the authority picks which address it connects to and you do not get a say.

On purpose. It fires on every box, and on a node that does not currently own the public address the challenge fails every single time. You end up with a mailbox full of failures from two of your three nodes and the real problem buried in it.

Renewal is driven from the manager, which works out which node can actually answer.

Settings, Certificates, Renew this many days before expiry. Thirty is the default and it is what Let's Encrypt suggest for ninety day certificates. That leaves a fortnight to notice a failure and still have plenty of time.

One that is not being used by any site can be deleted. One that is in use cannot, and the page says which site is using it. Point that site at something else first.

Settings, Certificates, Contact email. It is genuinely optional: certificates issue with no address at all, and the dashboard warns you either way. Use a shared mailbox more than one person reads, not somebody's personal address, because certificates outlive jobs.

The certificates page shows how many nodes hold each one. A certificate that only made it to one node is visible here rather than a surprise at the next failover. If one is missing, fix the peer link and reissue.

Pick the same certificate on each site. As long as the names on the certificate cover those sites, it works. A wildcard on ten subdomains is a common and sensible arrangement.

The trade off: one large certificate means one failed renewal takes every one of those sites with it.

Use dns-01 validation. http-01 needs the authority to reach the name over port 80, which it cannot do for something internal. With DNS credentials configured, the record goes into your zone and the name never has to be reachable.

Nothing gets deleted until the new certificate is live, so this can be done in the middle of the day.

1. Check the name points at one of your nodes and port 80 is open from the internet. Let's Encrypt has to reach it.
2. Certificates, Get one from Lets Encrypt.
3. Use Take the names from a site and pick the site. That fills in every name the site answers to, which is the step people get wrong when they type it by hand and leave out the www.
4. Leave the challenge on http, serve a file on port 80 unless you need a wildcard, which needs the dns one.
5. Key type ECDSA unless you still support very old clients.
6. Press Create and wait about thirty seconds.
7. Open the site, Basics tab, and change Certificate to the new one. Save, then Apply config.
8. Load the site and check the padlock. The issuer should now say Let's Encrypt.
9. Certificates, then Delete the old one. It will refuse while anything is still using it, which is a useful check that you did not miss a site.

Renewal from then on is automatic, and the manager works out which node can answer the challenge each time. If the bought certificate still has months left, there is no harm in leaving it in the list until it expires. It costs nothing and it is one keystroke back if you need it.

One thing to check first: if the certificate you bought covers something Let's Encrypt does not do, such as an organization validated or extended validation certificate that shows your company name, the free one is not the same product. For ordinary domain validated certificates, which is nearly all of them, it is exactly the same product for nothing.

The same shape, backwards. Get the certificate into the list first, then point the site at it, then tidy up.

1. Certificates, Make a signing request. Fill in the names it should cover, your company details and the country. The private key is made here and never leaves.
2. Send the request text to your supplier.
3. When the certificate comes back, find the request in the list and paste the certificate into it.
4. Open the site, Basics tab, change Certificate, save, then Apply config.

If the supplier offers ACME automation, set them up under Security, Paid Authorities instead. Then renewal is automatic and you never do this by hand again.