How SSL/TLS certificates work

Coritan gets SSL/TLS certificates from public certificate authorities and serves them on its network, so visitors reach your web proxies over HTTPS. A certificate covers one name, such as example.com, or several names in one zone, and it can include a wildcard such as *.example.com. Coritan does not charge for these certificates, and it renews them before they expire. You can also upload a certificate you bought elsewhere. The public SSL page describes the product.

A website's SSL/TLS tab works on one hostname at a time: the domain itself, or a name under it that is on Coritan's network, such as www.example.com. When the domain has more than one, choose it in Settings for. The tab's cards come in this order:

1. Encryption mode, Always use HTTPS, HSTS and TLS versions set how Coritan's network encrypts the hostname's traffic (Choose an encryption mode).
2. Certificate, Renewal, Weekly certificate limit, Request a certificate and Your own certificate cover the hostname's certificate, as this page describes. Which of them appear depends on the certificate's status.

While the domain has no hostname on Coritan's network, the tab shows example.com is not on our network yet in place of the first four cards, and the certificate cards are for the domain itself.

Coritan orders certificates with the ACME protocol. It asks Let's Encrypt first, then ZeroSSL, then Google Trust Services. It moves to the next authority when one refuses the order or has no allowance left for the domain that week. It does not move on when validation fails, because every authority checks the same proof.

The Issuer row on the Certificate card names the authority that issued a certificate, or says Uploaded by you. If the domain publishes CAA records, they must allow all three authorities (DNS record types).

Before an authority issues a certificate, it checks that you control the name. The Request a certificate card offers three ways to prove it:

Coritan DNS (automatic)

Coritan adds a TXT record named _acme-challenge to the zone, waits until its nameservers serve it, and deletes it after validation. You do nothing. It needs a zone that Coritan hosts, with the domain's nameservers set to Coritan's. This is DNS-01 validation.

Manual DNS TXT record

For a domain whose DNS is at another provider. You add the _acme-challenge TXT record there, with a value that Coritan shows you. This is DNS-01 validation too.

HTTP validation

The domain's A record must point at Coritan's network. The authority fetches a file from http://example.com/.well-known/acme-challenge/, and Coritan answers it. This is HTTP-01 validation.

A fourth choice, Let Coritan choose, picks HTTP validation when the name is on Coritan's network, Coritan DNS when Coritan hosts the zone, and HTTP validation otherwise. When HTTP validation fails and Coritan hosts the zone, Coritan tries again with Coritan DNS.

The Challenge row on the Certificate card shows how a certificate was validated: DNS-01, DNS-01, manual or HTTP-01.

With Coritan DNS (automatic), one certificate can cover more than the website's own name:

• Cover every name directly under example.com adds the wildcard *.example.com. It covers www.example.com and shop.example.com, so a new name has HTTPS as soon as it resolves. It does not cover example.com itself, or a name two levels down such as a.b.example.com.
• Other names adds names you type, such as www.example.com, up to 100 names on one certificate.

Every name must be in the same DNS zone of yours, and the zone must be active on Coritan DNS, because Coritan proves each name with a TXT record in that zone. A name that another account uses for a website cannot go on your certificate. On a certificate that has more than one name, the Covers row on the Certificate card lists the first five, and Show all lists the rest.

Once account plans open on your account, wildcards come with the Pro, Business and Enterprise plans. On the Free plan, the wildcard box is unavailable and the tab shows Wildcard certificates come with the Pro plan. A certificate with several names and no wildcard needs no plan.

When you claim a free coritan.gg name, Coritan requests a wildcard certificate for it, such as *.survival-smp.coritan.gg. The wildcard covers the name and every name directly under it, and the SSL/TLS tab says so when it is the certificate in use. When the one for a coritan.gg name was not requested, or you need it again, request it again through the API.

A certificate you bought from another certificate authority can replace the free one on a hostname. The Your own certificate card on the SSL/TLS tab uploads it for the hostname chosen in Settings for, and Coritan's network serves it for that name. The certificate must cover the name, be valid now and come from a certificate authority. Upload your own certificate has the steps.

Coritan does not renew a certificate you upload. About 30 days before it expires, Coritan replaces it with a free certificate, unless you upload a newer one first. Once account plans open on your account, uploads come with the Pro, Business and Enterprise plans.

Coritan's network serves a certificate for a name that has a web proxy. A new web proxy requests its own certificate while Request a certificate automatically is on, which it is by default. A certificate issued for a name with no web proxy stays on your account, and Coritan uses it when a web proxy for the name requests a certificate.

Without a certificate, Coritan's network answers HTTPS for the name with a certificate for another name, and browsers warn visitors.

The certificate cards on the SSL/TLS tab are for the hostname chosen in Settings for. When a wildcard covers the hostname, the cards show the wildcard, and Renew now and Remove certificate… act on the wildcard itself, for every name it covers.

pending

Coritan has ordered the certificate, and the authority is validating the name.

active

Issued or uploaded, and in use. The Expires row shows when it runs out.

failed

The last order or renewal failed, and The last request failed on the Certificate card gives the reason. A certificate that failed to renew stays in use until it expires.

expired

Past its expiry date, or replaced by a newer certificate for the same name.

revoked

You removed it, and Coritan no longer serves it. The SSL/TLS tab shows it as Removed.

Coritan checks certificates every day and renews an active certificate once it has 30 days or less left. It renews with the method and the names the certificate was issued with, so that proof must still work: the zone must still be at Coritan for Coritan DNS, and the name must still point at Coritan's network for HTTP validation.

A certificate validated with Manual DNS TXT record needs a new TXT value at each renewal, and Coritan cannot add it for you, so its automatic renewal fails. For a certificate that renews on its own, move the domain's DNS to Coritan or use HTTP validation. Renew or remove a certificate covers renewing by hand.

Certificate authorities limit how many certificates they issue for one registered domain in a week, so Coritan limits it too. The count covers every certificate for names under the registered domain, such as example.com for www.example.com. The Weekly certificate limit card on the SSL/TLS tab shows how many certificates were issued in the last seven days, out of the limit. At the limit, Coritan refuses new orders until older certificates leave the seven-day window.

List the certificates for the zones and registered domains on your account, newest first. per_page takes up to 100 and defaults to 25:

curl "https://api.coritan.com/api/v1/ssl/certificates?page=1&per_page=25" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

The answer is {"certificates": [...], "total": 3}, and the list includes certificates in every status.

Read the certificate that secures one name, with the issuance count for its registered domain:

curl https://api.coritan.com/api/v1/ssl/certificates/example.com/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "domain": "example.com",
  "has_certificate": true,
  "certificate": {
    "id": 118,
    "domain": "example.com",
    "route_id": 31,
    "zone_id": 42,
    "status": "active",
    "issuer": "letsencrypt",
    "challenge_method": "dns01",
    "issued_at": "2026-09-01T02:14:09",
    "expires_at": "2026-11-30T01:14:08",
    "last_renewal_at": "2026-09-01T02:14:09",
    "renewal_attempts": 0,
    "error_message": null,
    "created_at": "2026-09-01T02:12:51",
    "san_domains": ["example.com", "www.example.com"],
    "serial": null,
    "fingerprint_sha256": null,
    "requested_provider": null,
    "failover_from": []
  },
  "rate_limit": {
    "registered_domain": "example.com",
    "issued_last_7_days": 1,
    "limit": 45,
    "remaining": 44,
    "allowed": true
  },
  "wildcard": false
}

certificate is the newest certificate for the name. When the name has none, it is a wildcard that covers the name and wildcard is true, or null when nothing covers it. has_certificate is true only when that certificate is active.

san_domains lists every name on the certificate, its first name first, and a certificate issued for one name lists that name alone. issuer is letsencrypt, zerossl, google_trust_services, or custom for a certificate you uploaded. challenge_method is dns01, dns01_manual or http01, and null on an upload. renewal_attempts counts the failed attempts recorded for the certificate. This endpoint and the list leave serial, fingerprint_sha256, requested_provider and failover_from empty.

• Choose an encryption mode
• Issue an SSL/TLS certificate
• Upload your own certificate
• Renew or remove a certificate
• How web proxies work