Upload your own certificate

Upload a certificate you bought from another certificate authority, and Coritan's network serves it for one of the website's hostnames in place of the free one. Do this when you need a certificate from a particular authority. Otherwise the free certificate that Coritan issues and renews does the same job (How SSL/TLS certificates work).

• The hostname must be on Coritan's network, through a proxied DNS record or a web proxy. The Your own certificate card appears on the SSL/TLS tab only for such a hostname.
• You need the certificate and its private key in PEM form, and the chain when your certificate authority sent it as a separate file. A PEM certificate starts with -----BEGIN CERTIFICATE-----.
• The certificate must cover the hostname. A wildcard covers only names one level below it, so *.example.com does not cover example.com.
• The certificate must be valid now and issued by a certificate authority. A self-signed certificate is refused.
• The key must be an RSA key of at least 2048 bits, or an ECDSA key on the P-256 or P-384 curve, without a passphrase.
• Once account plans open on your account, uploads come with the Pro, Business and Enterprise plans.

1. In the dashboard, go to Domain Management, open the domain and select the SSL/TLS tab.
2. When the domain has more than one hostname on Coritan's network, choose the one the certificate is for in Settings for.
3. On the Your own certificate card, select Upload certificate…. The Upload a certificate page opens under the tab, for the hostname you chose.
4. In Certificate, paste the certificate. If you have a full-chain file, paste all of it.
5. In Private key, paste the private key.
6. If your certificate authority sent the intermediate certificates as a separate file, paste them in Chain, starting with the one that issued your certificate.
7. Select Upload certificate. To leave without uploading, select Cancel or the SSL/TLS link above the heading.

You can upload 10 certificates to one hostname in an hour.

The dashboard confirms Certificate for example.com uploaded. and takes you back to the SSL/TLS tab. The Certificate card shows the certificate as active, the Issuer row reads Uploaded by you, and the Expires row shows its expiry date. When the certificate lists more than one name, the Covers row lists them. Coritan's network serves it for the hostname.

Coritan does not renew a certificate you upload, so the Renewal card has no Renew now button for it. About 30 days before it expires, Coritan replaces it with a free certificate, unless you upload a newer one first. To keep your own, get a new certificate from your certificate authority before then and upload it the same way.

To go back to a free certificate sooner, remove this one, then request a new one on the Request a certificate card that appears on the same tab.

The SSL/TLS tab has no Your own certificate card

The domain has no hostname on Coritan's network, and the tab shows example.com is not on our network yet. Select Proxy a DNS record or Set up a web proxy there, then open the tab again.

The card shows Certificate uploads come with the Pro plan

Account plans are open on your account, and your plan leaves uploads out. Select Upgrade to Pro on the card, or see Account plans.

The private key does not belong to this certificate.

The key was made for another certificate. Find the key you created with this certificate's request.

The certificate does not cover example.com. It covers www.example.net.

The certificate is for other names. Get a certificate that lists the hostname, or choose the hostname it is for in Settings for.

The certificate is self-signed, so browsers would warn every visitor. Upload one that a certificate authority issued.

Upload a certificate from a certificate authority, or request a free certificate instead.

The certificate expired on 1 March 2026.

Get a new certificate from your certificate authority.

The certificate is not valid until 1 March 2027.

The certificate starts to be valid on that date. Upload it then.

The private key has a passphrase. Remove it and upload the key again.

Write the key out without its passphrase, for example with openssl pkey -in example.key -out example-open.key, which asks for the passphrase. Upload the new file.

The chain is out of order. Start with the certificate that issued yours, then the one that issued that, and so on.

Put the intermediate certificates in that order, in Chain or after the certificate.

The certificate is not in PEM form. A PEM certificate starts with -----BEGIN CERTIFICATE-----.

The file is in another format. Convert a .cer or .der file with openssl x509 -inform der -in example.cer -out example.pem.

The RSA key has 1024 bits. Use a key of at least 2048 bits.

Create a new key and certificate request, and have the certificate issued again.

Too many requests for this action. Try again later.

You uploaded 10 certificates to this website in the last hour. Wait, then try again.

• How SSL/TLS certificates work
• Issue an SSL/TLS certificate
• Renew or remove a certificate

Upload to a web proxy by its ID, with the PEM text as JSON strings. chain_pem is optional, and certificate_pem may hold the whole chain. With jq, the files go straight into the request:

jq -n --rawfile cert fullchain.pem --rawfile key example.key \
  '{certificate_pem: $cert, private_key_pem: $key}' |
curl -X POST https://api.coritan.com/api/v1/proxy/routes/31/certificate \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d @-

The answer is 200 with the names on the certificate and its expiry:

{
  "certificate_id": 91,
  "domain": "example.com",
  "names": ["example.com", "www.example.com"],
  "expires_at": "2027-03-01T23:59:59"
}

A certificate that does not check out answers 422 with one of the messages under Troubleshooting in detail, and the answer never repeats the key. The eleventh upload to one web proxy in an hour answers 429 with a Retry-After header. A web proxy that is not yours answers 404 with Route not found. Once account plans open on your account, a plan without uploads answers 402 with entitlement_exceeded.

Read the certificate status afterwards: it has issuer set to custom.