Key takeaways
- ACME lets a server prove it controls a domain and get a certificate with no human in the loop.
- An HTTP challenge covers single names, while a wildcard needs a DNS challenge because it proves control of the whole domain.
- Renew early and keep serving the old certificate if a renewal fails, so a hiccup never becomes an outage.
- Keys should be made on the server that uses them and never leave it.
An expired certificate takes a site down with a scary browser warning, and it nearly always happens because someone forgot. Automation is the cure, and it is simpler than it sounds.
How a certificate is issued
Certificate authorities such as Let's Encrypt use a protocol called ACME. Your server asks for a certificate for a name. The authority sets a challenge: prove you control this name. When the server passes, the authority signs a certificate. No person is involved, which is why renewal can run on a schedule.
The two challenges
An HTTP challenge places a small file on the website at a known address. It works for single names and is the usual choice for sites. A DNS challenge adds a temporary TXT record to the domain's zone. It is the only way to get a wildcard certificate such as *.example.com, because a wildcard speaks for every name under the domain.
RespireCloud supports both. Wildcards use the DNS challenge against zones hosted in the panel, and external DNS providers can be used for others. See the SSL feature and the DNS feature, and our Cloudflare integration for domains that live there.
Why automatic matters more every year
The industry is moving to shorter certificate lifetimes, so renewing by hand is becoming a chore that comes back more often. A panel that renews on its own removes the task. RespireCloud covers new sites and aliases automatically with one certificate per site, and renewals follow the authority's renewal information when it is offered, so they happen when the authority suggests.
What should happen when renewal fails
Failures happen: DNS is slow, a rate limit hits, a record is missing. A good panel keeps serving the current certificate and retries with growing waits, so a failed renewal is a warning rather than an outage. RespireCloud does that, and it can try several authorities in order and respect their rate limits. You can also upload your own certificate, which is checked for key match, expiry and chain order.
Keys and where certificates go
Private keys should be made on the server that uses them and never leave it. RespireCloud generates keys on the node, ECDSA P-256 by default, with P-384 and RSA as options. The certificate is deployed to websites, to the mail server and to the panel's own HTTPS, so one issue covers all three. Mail needs this too, see how to set up a mail server the right way.
A short checklist
Turn on automatic SSL for every site. Use a wildcard only where you really add subdomains often. Turn on HSTS once you are sure every subdomain serves HTTPS. Watch Certificate Transparency logs for certificates you did not request. More on this in the security checklist guide and on the security page. SSL in RespireCloud is built and verified in our test lab but not yet released.
Questions
What is a wildcard certificate?
A certificate for a domain and all of its direct subdomains, written *.example.com. One certificate then covers new subdomains without a new request.
Why does a wildcard need a DNS challenge?
Because the certificate authority must see that you control the whole domain, not only one web server. Adding a temporary TXT record to the domain's DNS zone proves that.
How often should certificates renew?
Certificate lifetimes are getting shorter across the industry, so renewal has to be automatic. A panel should renew well before expiry, when the authority suggests, and retry on failure.