Issue an SSL/TLS certificate

Issue a certificate for a hostname on its website's SSL/TLS tab. You choose how to prove that you control the name, and Coritan installs the certificate on the name's web proxy once the certificate authority issues it. With Coritan DNS, the same certificate can also cover a wildcard and other names in the zone. A new web proxy requests its own certificate, so you need these steps for a name that has none, or one whose certificate failed or expired. How SSL/TLS certificates work explains the validation methods.

• The domain must be on your Domain Management list: a zone that Coritan hosts, or a domain registered with Coritan.
• If the domain publishes CAA records, they must allow Let's Encrypt, ZeroSSL and Google Trust Services (DNS record types).
• The SSL/TLS tab shows the Request a certificate card when the name has no certificate, or when its certificate is failed, expired or revoked.
• The tab works on one hostname at a time: the domain itself, or a name under it that is on Coritan's network, such as www.example.com, chosen in Settings for. While the domain has no hostname on Coritan's network, the tab issues certificates for the domain itself.

Use this method when Coritan hosts the zone and the domain uses Coritan's nameservers. The dashboard selects it for you in that case. It is the only method that puts a wildcard or more than one name on a certificate.

1. In the dashboard, go to Domain Management, open the domain and select the SSL/TLS tab.
2. When the domain has more than one hostname on Coritan's network, choose the one the certificate is for in Settings for.
3. On the Request a certificate card, select Coritan DNS (automatic).
4. To cover every name directly under the hostname, such as shop.example.com, select Cover every name directly under example.com. The certificate then carries *.example.com as well.
5. To add other names, enter them in Other names, one per line, such as www.example.com. Each must be in the zone.
6. Select Start validation. The card shows Nothing to do, and lists the names the certificate covers when there is more than one.
7. Select Issue certificate.

A wildcard covers one level: *.example.com covers www.example.com, but not example.com or a.b.example.com. The certificate always covers the hostname it is for, so you do not add it. A certificate holds up to 100 names.

Once account plans open on your account, wildcards come with the Pro, Business and Enterprise plans. On the Free plan, the wildcard box is unavailable and the card shows Wildcard certificates come with the Pro plan with an Upgrade to Pro button. Other names need no plan.

Use this method when the domain's DNS is at another provider and the name does not point at Coritan's network. You create the record first with any value, then replace the value once Coritan has ordered the certificate.

1. In the dashboard, go to Domain Management, open the domain and select the SSL/TLS tab.
2. When the domain has more than one hostname on Coritan's network, choose the one the certificate is for in Settings for.
3. On the Request a certificate card, select Manual DNS TXT record, then Start validation. The card lists a TXT record named _acme-challenge.example.com with a TTL of 60, and its value is still empty.
4. At your DNS provider, create a TXT record at _acme-challenge.example.com with any value, such as pending.
5. Wait until the badge reads TXT record found, value differs, or select Check now.
6. Select Complete validation. The card shows Issuing the certificate.
7. After a few seconds, reload the page. The card shows the TXT record again, now with its value.
8. At your DNS provider, replace the record's value with the one shown. Do it within five minutes of step 6, because Coritan checks for the value for five minutes.

When public resolvers return the new value, the badge reads TXT record found and the certificate authority issues the certificate. You do not need to select Complete validation again. Delete the TXT record once the certificate is active.

The card keeps the challenge until it expires, so you can leave the tab and come back to it. When the name already has an active certificate, the card is called Challenge in progress, and the certificate it issues replaces the current one. To use another method, select Change method: the card is then called Replace the certificate and offers the methods again.

Use this method when the name points at Coritan's network, or when you can point it there.

1. In the dashboard, go to Domain Management, open the domain and select the SSL/TLS tab.
2. When the domain has more than one hostname on Coritan's network, choose the one the certificate is for in Settings for.
3. On the Request a certificate card, select HTTP validation, then Start validation. The card lists an A record for the name with Coritan's address as its value, and the addresses the name resolves to now.
4. If the badge reads Not pointed at our network, set the name's A record to the address shown at the DNS provider that answers for the domain.
5. Wait until the badge reads Ready. The card checks every few seconds, and Check now checks at once.
6. Select Complete validation. It stays unavailable until the name points at Coritan's network.

Keep the name pointed at Coritan's network after the certificate is issued. Renewal validates the same way.

A web proxy whose name is not under a domain on your Domain Management list has a page of its own in Game Shield, with a Certificate card on its Overview tab that requests a certificate in one step.

1. In the dashboard, go to Game Shield and open the web proxy in the Web proxies tab.
2. On the Overview tab, find the Certificate card and select Request certificate. The button appears when the proxy has no active certificate and none is being issued.

The card shows Issuance in progress while the certificate authority validates the name. Coritan uses a certificate that already covers the name when there is one. Otherwise it validates over HTTP, so the name must point at Coritan's network, and it falls back to Coritan DNS when Coritan hosts the zone.

The dashboard confirms Certificate issuance for example.com started. The Certificate card shows pending while the certificate authority validates the name, then active with the Issuer and Expires rows. The web proxy for the name serves the certificate. For a domain with no hostname on Coritan's network, the card says so before you start, and the certificate waits on your account until a web proxy for the name requests one.

This domain has reached its weekly certificate limit.

The registered domain is at its weekly limit, and Start validation is unavailable. Wait until the count on the Weekly certificate limit card falls.

Rate limit: 45/45 certificates issued by all authorities for example.com in the past 7 days

The same limit, reported when you start validation. Wait until older certificates leave the seven-day window.

You must own this domain via registration, DNS zone, or proxy route

The name is not on your account. Add its zone first (Add a domain you already own).

No TXT record found at _acme-challenge.example.com. Please add the record and try again.

Public resolvers do not return a TXT record at that name yet. Check the record's name at your DNS provider, wait for it to appear, and select Complete validation again.

Domain does not resolve to this server (203.0.113.10). Current IPs: none. Update your A record and try again.

The name does not point at Coritan's network. Set its A record to the address in the message and try again once the change has spread.

Certificate issuance already in progress

Coritan is already issuing a certificate for the name. Wait for the Certificate card to show the result.

www.example.net is not in the example.com zone.

A name in Other names is outside the website's zone. Request its certificate from the SSL/TLS tab of its own domain.

*.example.com covers www.example.com already. Remove www.example.com, or leave out the wildcard.

The wildcard already covers that name, so the certificate cannot list it too. Remove the name from Other names, or clear the wildcard box.

blog.example.com is a website on another account, so it cannot go on your certificate.

Another account uses that name for a website. Remove it from Other names.

These names are in different DNS zones (example.com, shop.example.com). Request one certificate per zone.

Some names are in a separate zone of yours, such as a zone for shop.example.com. Request one certificate for each zone.

example.com is not active on Coritan DNS yet, so the certificate authority cannot check www.example.com. Point the domain's nameservers at Coritan first.

A certificate with a wildcard or more than one name needs the zone to answer on Coritan DNS. Set the domain's nameservers to Coritan's, or request a certificate for the website's name alone.

The last request failed mentions DNS verification failed

Coritan did not see the TXT value within five minutes. Start again with Manual DNS TXT record, and replace the value as soon as it appears.

The last request failed mentions HTTP verification failed

Coritan could not fetch the validation file from the name over HTTP. Check that the name resolves only to Coritan's address and that nothing blocks port 80 on the way. Then start again. When the message says an address is not ours, the name resolves to a server outside Coritan's network. Point the name at the address that HTTP validation shows, where the domain's DNS is hosted, then start again.

The last request failed mentions has an AAAA record

The name has an AAAA record for an address outside Coritan's network. The certificate authority checks a name's IPv6 address first, so the check would reach the server at that address instead. Delete the AAAA record where the domain's DNS is hosted, wait for its TTL to pass, then start again. When Coritan hosts the zone, turning Proxied on for the name's A record also works, because a proxied name answers AAAA queries only with the addresses of Coritan's network (Proxied records).

The last request failed starts with DNS lookup failed

The certificate authority could not look the name up at the nameservers that answer for the domain, and the message quotes what it reported. SERVFAIL looking up CAA means those nameservers failed a CAA query. Certificate authorities make that query for every name, even when the domain has no CAA records. Fix the nameservers where the domain's DNS is hosted, then start again.

The last request failed starts with A CAA record does not allow

A CAA record for the domain does not allow the certificate authorities that Coritan uses. Add an issue record for each one (Before you begin names them), then start again. A message that mentions CAA record and prevents issuance has the same cause.

• How SSL/TLS certificates work
• Upload your own certificate
• Renew or remove a certificate
• Create a web proxy

The SSL/TLS tab runs a challenge in three calls: start it, read its status, then complete it. Start a challenge with a method of auto (the default), dns_automatic, dns_manual or http:

curl -X POST https://api.coritan.com/api/v1/ssl/challenges/start \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "method": "http"}'

The answer is 201 with what to do next. auto answers with the method it picked:

{
  "domain": "example.com",
  "method": "http",
  "status": "not_pointed",
  "txt_name": null,
  "txt_value": null,
  "expected_ip": "203.0.113.10",
  "current_ips": ["198.51.100.7"],
  "is_pointed": false,
  "instructions": "Point your domain's A record to 203.0.113.10, then call the /complete endpoint. Current resolution: 198.51.100.7",
  "created_at": "2026-09-25T10:00:00Z",
  "expires_at": "2026-09-25T11:00:00Z"
}

status is ready or not_pointed for http, and ready for dns_automatic. For dns_manual it starts as awaiting_order, with txt_name set and txt_value still null. Read it again with the status call. For a manual challenge the status is awaiting_record while there is no record, txt_found while the record holds another value, and verified once it holds txt_value. Without a manual challenge in progress, the call reports whether the name points at Coritan's network:

curl https://api.coritan.com/api/v1/ssl/challenges/example.com/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Complete an http or dns_manual challenge to order the certificate. The answer is 202:

curl -X POST https://api.coritan.com/api/v1/ssl/challenges/example.com/complete \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "message": "Certificate issuance started via HTTP verification",
  "job_id": 5812,
  "domain": "example.com"
}

For dns_manual the message is Certificate issuance started via manual DNS verification. Read the status again after a few seconds: txt_value now holds the value to publish.

A dns_automatic challenge has nothing to complete. Order the certificate directly instead, which is what Issue certificate does. challenge_method is dns01 or http01, and leaving it out lets Coritan choose. route_id installs the certificate on the web proxy with that ID, for the same name, and the tab sends it for the hostname chosen in Settings for:

curl -X POST https://api.coritan.com/api/v1/ssl/certificates \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "challenge_method": "dns01", "route_id": 31}'

{
  "message": "Certificate issuance queued",
  "job_id": 5813,
  "domain": "example.com"
}

The call answers 403 with You must own the domain's DNS zone or domain registration for a name outside your zones and registered domains, and 404 with Route not found or access denied for a route_id that is not yours. Poll the certificate status until certificate.status is no longer pending.

Put the other names in extra_domains. domain or any of them may be a wildcard such as *.example.com. Every name must be in one DNS zone of yours that is active on Coritan DNS, and challenge_method may be left out or set to dns01. With route_id, the web proxy's own name must be on the certificate, and it becomes the first name:

curl -X POST https://api.coritan.com/api/v1/ssl/certificates \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "extra_domains": ["*.example.com"], "route_id": 31}'

The answer is 202 and lists every name in domains:

{
  "message": "Certificate issuance queued",
  "job_id": 5815,
  "domain": "example.com",
  "domains": ["example.com", "*.example.com"]
}

A name that does not fit answers 422 with one of the messages under Troubleshooting in detail. A name the wildcard covers answers 422 as a validation error, whose msg reads Value error, www.example.com already covered by *.example.com; remove either the wildcard or the names under it. Once account plans open on your account, a wildcard on a plan that leaves wildcard certificates out answers 402 with entitlement_exceeded.