Add and issue certificates
One certificate can cover one name, many names, or every subdomain with a wildcard.
Add a certificate
Certificates > Add certificate (from Get started, the form opens with your DNS provider already filled in).
- Domain (primary / CN): the main name, such as
www.example.comor*.example.com. - Contact email: used once, to create your account at the certificate authority the first time NeverLapse issues anything (the CA may email it about your account).
- Subject Alternative Names: more names on the same certificate, one per line.
- DNS provider: GoDaddy, Cloudflare, Azure DNS, Amazon Route 53, Google Cloud DNS, Namecheap, IONOS, cPanel, DigitalOcean, DNS Made Easy, DNSimple, Name.com, BIND, Windows DNS (NeverLapse on Windows only), Manual, or under Other NeverLapse DNS. New certificates start on the DNS provider you set up and tested in Get started; if you haven't set one up, on NeverLapse DNS. Below it are that provider's settings: the zone (optional), and a saved account or Add new account. See DNS providers.
Wildcards
*.example.com covers www.example.com, mail.example.com and so on, but not example.com itself. To cover both, put *.example.com as the domain and example.com as an alternative name (or the other way round). NeverLapse handles both validations at once.
Different DNS zones on one certificate
All names on a certificate are validated through the DNS provider and zone chosen for it. To cover names in zones at different providers, make separate certificates.
Issue it
Click Issue now next to the certificate (or Save and issue on a new one). A window opens and shows each step as it happens: the DNS record going in, the wait until it's visible, the certificate authority's check, the new certificate. You can close it and it keeps going.
- If the DNS host is slow, NeverLapse keeps checking for about 15 minutes. If something needs a fix (for example a contact email the certificate authority won't accept), it stops at once, says what to fix and offers a Fix it button.
- If it fails, the reason shows on the Certificates page, and is emailed if alerts are set up.
- Issue now doesn't install the new certificate on hosts by itself. Click Deploy all now on the Dashboard afterwards, or wait for the nightly check, which always deploys.
Status on the Certificates page
| Status | Meaning |
|---|---|
| Not issued | Added, not issued yet. Click Issue now. |
| Starting / Issuing | NeverLapse is working on it. Click View progress to open the window. |
| Waiting for you | Manual DNS or NeverLapse DNS: records to add. Click Add DNS records. |
| Healthy | Issued and not close to expiry. |
| Expiring | Close to expiry; the nightly check renews it (or click Renew now). |
| Renewal failing | Still valid, but renewing it keeps failing. The reason shows under the status. |
| Expired | Past its expiry date. Click Renew now. |
| Failed | The last attempt failed. The reason shows under the status; click it for the full text, fix it and click Issue now. |
Other actions
- Edit: change names, DNS provider or account. New names take effect at the next issue or renewal.
- Download PFX: the certificate with its private key, protected by a password you see with PFX password. Treat the file like a password.
- Revoke with <your CA> (e.g. Revoke with Let's Encrypt): use it if the private key may have leaked. A revoked certificate stops being trusted; issue a new one right after.
- Delete from NeverLapse: stops managing it. Copies already installed on hosts stay there until they expire.
A certificate for NeverLapse itself
Issue a certificate for the name you open NeverLapse by (for example certs.yourcompany.com), then choose it under Settings > Web server certificate. From then on the console's own certificate renews itself, with no restart.