Every setting explained

Everything under Settings in the NeverLapse menu, in the order the page lists it. Most of it can stay at the defaults.

The Settings page opens as a list, one setting area per row. Prefer big tiles? Click Tiles at the top right; your choice is remembered in that browser (NeverLapse Cert 1.8.4 or newer).

License

Your key, plan, limits and the daily check-ins. See Your license.

Updates

The installed version, the latest one out, Check for updates and Install <version> (backup first, automatic rollback if the new version doesn't start). NeverLapse Cert 1.9.0 or newer. See Updates.

Renewal

  • Renew when a certificate is within ... days of expiring: default 30. The certificate authority decides how long its certificates last; this only sets how early NeverLapse renews, so a smaller number means less time to fix a problem before expiry.
  • Daily renewal check time: server time, default 2:00 AM.

How renewals work: Renewals and alerts.

Server address

One address for everything: people open the console and agents fetch certificates on the same DNS name and port.

  • DNS name: the name people and agents use, such as certs.yourcompany.com. Point it at this server in DNS (inside and outside, if agents are on both sides) and give the console a certificate that covers it (below). Blank uses the server's own name. New install commands, install keys and download links use it immediately; agents already installed keep their address until you run their install command again.
  • Port: 443 is normal. If the console runs on another port, Move the web interface to port checks the new port is free, updates the setting and the firewall rule, and restarts the console there. If it doesn't come up within a minute, it goes back to the old port by itself. On Linux, Move the web interface to port saves the new port and restarts the console, which comes back on it; open the port in your firewall if one is running. There's no automatic return to the old port on Linux. In Docker the port can't be changed here: edit NEVERLAPSE_PORT in .env and run docker compose up -d.

Web server certificate

The HTTPS certificate of the NeverLapse console itself. Shows the one in use: who it's for, who issued it, when it expires. Changes apply at once, no restart.

  • Use a NeverLapse certificate (recommended): issue a certificate for the console's name on the Certificates page, then pick it here. Every renewal is switched in automatically (checked every 15 minutes).
  • Upload a certificate: a .pfx/.p12 with its private key and its password. It's installed on the server; the uploaded file and password aren't kept (on Linux and Docker there's no certificate store: the certificate and its chain are saved as a file in the data folder, readable only by the NeverLapse service). An uploaded certificate doesn't renew itself.

The page warns if the certificate doesn't cover the name you're browsing on.

Email (SMTP)

Used for password reset emails and failure alerts.

  • Host and Port: your mail server or relay (for example smtp.office365.com, 587).
  • Use SSL/TLS: STARTTLS on port 587, implicit TLS on port 465. Off for a plain internal relay on port 25.
  • From address and From name: what alerts come from.
  • Username and Password (optional): leave blank for a relay that accepts mail from this server without a login.
  • Send Test Email to Myself: sends a test to the address you're signed in with.

DNS Propagation Check

Before asking the certificate authority to check a domain, NeverLapse asks the domain's own authoritative name servers whether the validation record is really there. That avoids failures from internal DNS servers with their own copy of your domain, and from DNS caches.

  • Bootstrap DNS servers (optional): only used to find out which name servers are authoritative. Google (8.8.8.8) and Cloudflare (1.1.1.1) are always used anyway. Add servers only if those two aren't reachable from this server. Leave blank in almost every case.

Certificate Issuance Notifications

  • Notify on issuance failure: the address that gets an email when an Issue now attempt fails (problems that need a fix stop at once; slow DNS is retried for about 15 minutes), when a nightly renewal fails, or when a renewed certificate can't be installed on a host. Needs Email (SMTP) set up.
  • Also email this address when a certificate is issued or renewed (off by default): a short email with the new expiry date and where the certificate was deployed. Turn it on if the certificate is also used somewhere NeverLapse doesn't update, such as a firewall: the email is your cue to re-import it there.

Data Protection Certificate

Every secret NeverLapse stores (DNS tokens, Windows logins, API keys) is encrypted with keys protected by this certificate. A database backup alone can't be decrypted without it, which also means losing it loses every stored secret.

  • Download a backup: choose a password (at least 12 characters) and download a protected copy. Keep it somewhere other than this server, such as your password manager. Do this right after installing.
  • Restore from a backup: for a rebuilt or new server pointed at the same database. Upload the file, enter its password and confirm.

See Backup, upgrade, move, uninstall.

Sign-in & security

Single sign-on (SAML) and requiring an authenticator app. See Users, MFA and single sign-on.

Users

Who can sign in. See Users.

Pull Agents

  • Endpoint: turns agent check-ins on or off for the whole server. Changes here restart the NeverLapse service for a few seconds (renewals and the console aren't affected).
  • Shared token: the token every agent signs in with. Regenerate only if you think it leaked: every installed agent stops working until you run its install command again.
  • Install commands: one per agent host, for Linux and Windows, ready to copy.
  • Agent updates (1.3.7 and later): Update agents automatically. Off by default: after you upgrade NeverLapse you pick which agents to update on the Hosts page. On: every agent updates itself at its next check-in. See Agent updates.

More: Pull agents.

Credentials (menu)

Every saved secret, in four groups (NeverLapse Cert 1.8.4 or newer). Click a group's header to fold it away; your choice is remembered in that browser.

  • DNS accounts: what NeverLapse uses to add the proof record at your DNS host (GoDaddy, Cloudflare, Azure DNS, Amazon Route 53, Google Cloud DNS, Namecheap, IONOS, cPanel, DigitalOcean, DNS Made Easy, DNSimple, Name.com, BIND, Windows DNS).
  • Host logins: what NeverLapse uses to install certificates on your servers and devices (Windows logins, OPNsense API keys, private key passphrases).
  • Other secrets: anything else you saved here.
  • Managed by NeverLapse (starts folded): made and used by NeverLapse itself: the pull agent token, the email server login, PFX passwords, NeverLapse DNS and acme-dns accounts, and certificate authority account keys (EAB). They aren't edited here: each row has an Open button to the page where it's changed.
  • Every row shows the Type, the Username (if it has one) and Used by: the certificates, hosts and certificate authorities that use it, each a link. One search box finds a credential by name, type, certificate or host.
  • The secrets themselves are never shown. Secrets are write-only once saved.
  • Add credential makes any kind ahead of time, including the API DNS accounts with every field that provider needs.
  • Edit changes the name, the username and the secret in one form; for an API DNS account, every field of that provider. Leave a secret box blank to keep what's saved. Renaming doesn't affect anything using it. The edit page lists what uses the credential; a change applies to all of them at once.
  • Delete only works when nothing uses the credential. Switch those certificates or hosts to another account first.
  • Accounts are shared: one Cloudflare token or Windows login can serve many certificates or hosts.
Previous Firewalls: FortiGate, ASA, Firepower NextUsers, MFA and single sign-on