SSL certificates

When a browser opens an https:// address, the browser and the server encrypt everything they send each other, so nobody on the network between them can read it or change it. The encryption is called TLS, and people still use SSL, the name of the older version it replaced. Mail apps use the same encryption to talk to a mail server.

Encryption alone does not tell the browser who is at the other end. A certificate does. It is a file that says a server may answer for a name, such as www.example.com, signed by a certificate authority that browsers trust. Without a valid certificate for the name, the browser warns visitors before it shows the page.

A certificate lasts a limited time, so it has to be renewed before it expires.

Before an authority signs a certificate, it asks for proof that whoever asked controls the name, in one of two ways:

DNS validation

A TXT record with a value the authority chooses, published under the name in DNS.

HTTP validation

A file with a value the authority chooses, served by the website at a path the authority sets.

The proof has to work again at every renewal, so the method you choose decides whether renewal can happen without you.

• Coritan gets certificates from public certificate authorities and does not charge for them. Each certificate covers one name, so example.com and www.example.com each get their own.
• Coritan's edge serves the certificate for each name that has a web proxy. A new web proxy asks for its certificate by itself (Web proxies, origins and the WAF).
• When Coritan hosts the domain's DNS, it adds and removes the validation record for you. Coritan renews an active certificate once it has 30 days or less left (How SSL/TLS certificates work).
• A certificate validated with a record you added at another DNS provider cannot renew by itself, because each renewal needs a new value that Coritan cannot publish there (Renewal).

• Put a website online, with a certificate from the start
• Issue an SSL/TLS certificate
• Create a web proxy