Requirements
One server runs NeverLapse: Windows, Linux or Docker. Setup installs everything else it needs.
The NeverLapse server
- Windows Server 2016 or newer (or Windows 10 version 1607 or newer), 64-bit. A virtual machine is fine.
- Or Ubuntu 22.04/24.04 or Debian 12/13, x86-64 with systemd, or Docker. See Install on Linux or Docker.
- Administrator rights to run Setup.
- Setup installs the .NET 10 runtimes itself (they're inside the installer, so no internet is needed for them).
- IIS is not needed: NeverLapse runs its own HTTPS web server (a Windows service, or a systemd service on Linux).
Database
Pick one in the installer:
- SQL Server Express on the same server (the default; the current free version from Microsoft, SQL Server 2025 Express at the time of writing). Setup downloads it from Microsoft and sets up the instance, database and login. On a server without internet, put
SQLEXPR_x64_ENU.exe(from Microsoft) in the same folder as the NeverLapse installer. - An existing SQL Server you already run. NeverLapse needs one empty database; Setup can create it if its login is allowed to.
- On Linux and Docker: PostgreSQL (installed for you, or your own PostgreSQL 14 or newer on Linux).
DNS access
NeverLapse proves domain ownership with a DNS record, so it needs to change DNS for each domain you want certificates for. You need one of:
- Cloudflare: an API token that can edit the zone's DNS.
- GoDaddy: a Personal Access Token with DNS update rights.
- Azure DNS, Amazon Route 53, Google Cloud DNS, Namecheap, IONOS, cPanel, DigitalOcean, DNS Made Easy, DNSimple or Name.com: that provider's API key or app login, limited to DNS records where the provider allows it.
- BIND: a TSIG key allowed to update the zone.
- Windows DNS (usually a domain controller): a Windows account that may change the zone (needs NeverLapse on a Windows server; on Linux or Docker use another provider or Manual DNS).
Details for each: Connect your DNS provider.
Network
| From | To | Port | Why |
|---|---|---|---|
| NeverLapse server | Let's Encrypt, or the other CA you use (internet) | TCP 443 | Requesting certificates |
| NeverLapse server | neverlapse.live | TCP 443 | Daily license check-in |
| NeverLapse server | dns1.neverlapse.live, dns2.neverlapse.live | TCP 443 | Only with NeverLapse DNS: the challenge updates |
| NeverLapse server | Your DNS provider's API (Cloudflare, GoDaddy, Azure, Route 53 and the other API providers) | TCP 443 | Adding and removing the validation record |
| NeverLapse server | The internet's DNS servers | TCP/UDP 53 | Checking the validation record is visible before asking the certificate authority |
| NeverLapse server | Your BIND server | TCP/UDP 53 | BIND dynamic updates |
| NeverLapse server | Windows DNS servers and Windows push hosts | TCP 135, 445 and the dynamic RPC ports | WMI (Windows DNS, Windows and Veeam push hosts). Windows server only. |
| Your browser | NeverLapse server | TCP 443 (or the port you pick) | The web console |
| Agents | NeverLapse server | TCP 443 (same port) | Agents collecting certificates |
On Windows, Setup opens the web port in Windows Firewall for you; on Linux, open it in your firewall if one is running. If you only use agents and cloud DNS, nothing needs to connect into your other servers.
Servers that receive certificates
- Windows: Windows Server with the NeverLapse agent (any network), or, from a NeverLapse server on Windows, reachable over WMI from the NeverLapse server (same domain or trusted network).
- Linux: x86_64 with systemd gets the native agent (RHEL, Rocky, Alma, Oracle Linux 8 and 9, Ubuntu 20.04+, Debian 11+, SLES 15, Amazon Linux 2023). Older systems (such as CentOS 7), ARM or no systemd get a script agent run by cron.
- Veeam Cloud Connect: Veeam Backup & Replication with its PowerShell module. Veeam 13 needs PowerShell 7 on that server for the agent.
- OPNsense with the HAProxy plugin and an API key.
- VMware Cloud Director 10.4+ cell: the native agent on each cell, run as root (x86_64, systemd).