# How SSL/TLS certificates work > How Coritan issues, validates and renews free SSL/TLS certificates for your domains. Source: https://www.coritan.com/docs/websites/ssl/ In the dashboard: - /dashboard/websites/…/ssl: https://www.coritan.com/dashboard/websites Coritan gets SSL/TLS certificates from public certificate authorities and installs them at the edge, so visitors reach your web proxies over HTTPS. A certificate you request covers one name, such as `example.com` or `www.example.com`. Coritan does not charge for certificates, and it renews them before they expire. ## Certificate authorities Coritan orders certificates with the ACME protocol. It asks Let's Encrypt first, then ZeroSSL, then Google Trust Services. It moves to the next authority when one refuses the order or has no allowance left for the domain that week. It does not move on when validation fails, because every authority checks the same proof. The **Issuer** row on the **Certificate** card names the authority that issued a certificate. If the domain publishes `CAA` records, they must allow all three authorities ([DNS record types](/docs/websites/dns/record-types/#rules-for-some-types)). ## Validation Before an authority issues a certificate, it checks that you control the name. The **SSL** tab offers three ways to prove it: **Coritan DNS (automatic)** : Coritan adds a `TXT` record named `_acme-challenge` to the zone, waits until its nameservers serve it, and deletes it after validation. You do nothing. It needs a zone that Coritan hosts, with the domain's nameservers set to Coritan's. This is DNS-01 validation. **Manual DNS TXT record** : For a domain whose DNS is at another provider. You add the `_acme-challenge` `TXT` record there, with a value that Coritan shows you. This is DNS-01 validation too. **HTTP validation** : The name must resolve to the Coritan edge. The authority fetches a file from `http://example.com/.well-known/acme-challenge/`, and the edge answers it. This is HTTP-01 validation. A fourth choice, **Let Coritan choose**, picks HTTP validation when the name has a web proxy, Coritan DNS when Coritan hosts the zone, and HTTP validation otherwise. When HTTP validation fails and Coritan hosts the zone, Coritan tries again with Coritan DNS. The **Challenge** row on the **Certificate** card shows how a certificate was validated: `DNS-01`, `DNS-01, manual` or `HTTP-01`. ## Where certificates are served The edge serves a certificate for a name that has a [web proxy](/docs/proxies/web-proxies/). A new web proxy requests its own certificate while **Request a certificate automatically** is on, which it is by default. A certificate issued for a name with no web proxy stays on your account, and Coritan uses it when a web proxy for the name requests a certificate. Without a certificate, the edge answers HTTPS for the name with a certificate for another name, and browsers warn visitors. When you claim a free coritan.gg name, Coritan requests a wildcard certificate for it, such as `*.survival-smp.coritan.gg`. The wildcard covers the name and every name directly under it, and the **SSL** tab says so when it is the certificate in use. You cannot request a wildcard certificate for any other name. When the one for a coritan.gg name was not requested, or you need it again, [request it again through the API](/docs/proxies/coritan-gg-names/#request-the-wildcard-certificate-again). ## Certificate statuses `pending` : Coritan has ordered the certificate, and the authority is validating the name. `active` : Issued and in use. The **Expires** row shows when it runs out. `failed` : The last order or renewal failed, and **The last request failed** on the **Certificate** card gives the reason. A certificate that failed to renew stays in use at the edge until it expires. `expired` : Past its expiry date, or replaced by a newer certificate for the same name. `revoked` : You revoked it, and Coritan no longer serves it. ## Renewal Coritan checks certificates every day and renews an `active` certificate once it has 30 days or less left. It renews with the method the certificate was validated with, so that proof must still work: the zone must still be at Coritan for Coritan DNS, and the name must still resolve to the edge for HTTP validation. A certificate validated with **Manual DNS TXT record** needs a new `TXT` value at each renewal, and Coritan cannot add it for you, so its automatic renewal fails. For a certificate that renews on its own, move the domain's DNS to Coritan or use HTTP validation. [Renew or revoke a certificate](/docs/websites/ssl/renew-or-revoke-a-certificate/) covers renewing by hand. ## Issuance limit Certificate authorities limit how many certificates they issue for one registered domain in a week, so Coritan limits it too. The count covers every certificate for names under the registered domain, such as `example.com` for `www.example.com`. The **Issuance limit** card on the **SSL** tab shows how many certificates were issued in the last seven days, out of the limit. At the limit, Coritan refuses new orders until older certificates leave the seven-day window. ## Read certificates with the API List the certificates for the zones and registered domains on your account, newest first. `per_page` takes up to 100 and defaults to 25: ```bash curl "https://api.coritan.com/api/v1/ssl/certificates?page=1&per_page=25" \ -H "Authorization: Bearer $CORITAN_TOKEN" ``` The answer is `{"certificates": [...], "total": 3}`, and the list includes certificates in every status. Read the certificate that secures one name, with the issuance count for its registered domain: ```bash curl https://api.coritan.com/api/v1/ssl/certificates/example.com/status \ -H "Authorization: Bearer $CORITAN_TOKEN" ``` ```json { "domain": "example.com", "has_certificate": true, "certificate": { "id": 118, "domain": "example.com", "route_id": 31, "zone_id": 42, "status": "active", "issuer": "letsencrypt", "challenge_method": "dns01", "issued_at": "2026-09-01T02:14:09", "expires_at": "2026-11-30T01:14:08", "last_renewal_at": "2026-09-01T02:14:09", "renewal_attempts": 0, "error_message": null, "created_at": "2026-09-01T02:12:51", "san_domains": [], "serial": null, "fingerprint_sha256": null, "requested_provider": null, "failover_from": [] }, "rate_limit": { "registered_domain": "example.com", "issued_last_7_days": 1, "limit": 45, "remaining": 44, "allowed": true }, "wildcard": false } ``` `certificate` is the newest certificate for the name. When the name has none, it is a wildcard that covers the name and `wildcard` is `true`, or `null` when nothing covers it. `has_certificate` is `true` only when that certificate is `active`. `issuer` is `letsencrypt`, `zerossl` or `google_trust_services`, and `challenge_method` is `dns01`, `dns01_manual` or `http01`. `renewal_attempts` counts the failed attempts recorded for the certificate. This endpoint and the list leave `san_domains`, `serial`, `fingerprint_sha256`, `requested_provider` and `failover_from` empty. ## Related - [Issue an SSL/TLS certificate](/docs/websites/ssl/issue-a-certificate/) - [Renew or revoke a certificate](/docs/websites/ssl/renew-or-revoke-a-certificate/) - [How web proxies work](/docs/proxies/web-proxies/) ## API - `GET /api/v1/ssl/certificates`: List SSL certificates for the authenticated user (https://www.coritan.com/docs/api/reference/client/ssl/#op-get-api-v1-ssl-certificates) - `GET /api/v1/ssl/certificates/{domain}/status`: Get SSL certificate status for a domain (https://www.coritan.com/docs/api/reference/client/ssl/#op-get-api-v1-ssl-certificates-domain-status)