Free SSL certificates for your sites
Free SSL certificates for every site behind Edge Proxy, issued and renewed for you. Pro adds wildcard certificates and your own certificates.
Every site you put behind Edge Proxy gets a free SSL certificate, so visitors reach it over HTTPS. We order it, install it and renew it for you. From Pro, one wildcard certificate covers every name under a domain, and you can upload a certificate of your own.
- Free certificates on every plan
- 100 names on one certificate
- 30 days left when we start to renew one
SSL on each plan
Certificates come with every plan. Your plan sets which kinds you can use and how many websites you can have.
Free
A free certificate for each site.
- Free certificates, renewed for you
- Up to 100 names on one certificate
- Proof of the name through our DNS, a DNS record you add, or HTTP
Pro
Wildcard certificates and your own certificates.
- Wildcard certificates for every name directly under a domain
- Your own certificate on any site
- Everything in Free
Business
The same certificates for more websites.
- 50 websites
- Everything in Pro
Compare every plan · Talk to sales about Enterprise
Technical specifications
How we order, prove, serve and renew a certificate, and what limits apply.
| Issuing | |
|---|---|
| How we order | Over ACME, from public certificate authorities |
| When an authority refuses | We ask the next one: a refusal, or no allowance left for the domain that week. A failed validation does not move on, because every authority checks the same proof. |
| Proving the name | Through our DNS (automatic), with a DNS TXT record you add at another provider, or over HTTP when the name points at our network |
| Where it is served | For each name that has a web proxy |
| Names | |
| Names on one certificate | Up to 100 |
| Wildcard certificates (Pro and up) | Every name directly under a domain, such as *.example.com. It does not cover example.com itself, or a name two levels down. |
| Where the names must be | In one DNS zone of yours that is active on our DNS, because we prove each name with a TXT record in it |
| Renewal | |
| Checked | Every day |
| Renewed | Automatic, when 30 days are left, with the method and names it was issued with |
| A manual DNS record | A certificate proved with a TXT record you add does not renew by itself, because each renewal needs a new value |
| Your own certificate | |
| Plan | Pro and up |
| Renewal | We do not renew it. About 30 days before it expires, we replace it with a free certificate unless you upload a newer one. |
| Weekly limit | |
| New certificates in a week | Up to 45 from the first authority and 90 from each of the other two, for one registered domain |
| What counts | Every certificate for a name under the registered domain, such as example.com for www.example.com |
| At the limit | We refuse new orders until older certificates leave the seven-day window. The SSL/TLS tab shows how many you have used. |
| How visitors connect | |
| Encryption mode | Flexible, Full or Full (strict), for each hostname |
| Always use HTTPS and HSTS | Switches on the SSL/TLS tab, once the hostname has an active certificate |
| TLS versions | TLS 1.3 and TLS 1.2 |
How a certificate gets to your site
Each step is automatic once the name is behind Edge Proxy.
- A name goes behind Edge Proxy. A new web proxy asks for its own certificate, unless you turn that off. You can also request one from the SSL/TLS tab.
- We prove the name is yours. We add a TXT record to your zone when we host its DNS, check a record you add at another provider, or answer a request over HTTP.
- The authority issues it. We install it on our network, and the SSL/TLS tab shows its status, its issuer and when it expires.
- We renew it. We check every day. A certificate renews when 30 days are left, with the method and names it was issued with.
What customers do with SSL
HTTPS for a new site
Create a web proxy for the site’s name. We order a certificate for it, and visitors reach the site over HTTPS once it is active.
Uses: Edge Proxy and a certificate
One certificate for many names
On Pro, with the domain’s DNS on Coritan, order a wildcard such as *.example.com. A new name under the domain has HTTPS as soon as it resolves.
Uses: DNS, a wildcard certificate and Edge Proxy
A certificate from another authority
Upload the certificate and its key on the SSL/TLS tab. It replaces the free one on that name, and you upload a new one before it expires.
Uses: A Pro plan and a certificate you bought
Guides for SSL
Our docs explain each step, from the first certificate to a renewal.
- How SSL/TLS certificates work: How we issue, validate and renew free certificates, and serve the ones you upload.
- Issue an SSL/TLS certificate: Request a certificate with our DNS, a TXT record at another provider, or HTTP validation.
- Choose an encryption mode: Choose how our network connects to your server, and turn on Always use HTTPS and HSTS.
- Upload your own certificate: Serve a certificate you bought from another authority.
- Renew or remove a certificate: Renew a certificate by hand, or remove one we no longer serve.
Put your site on HTTPS
Start on the Free plan, put a name behind Edge Proxy, and we order its certificate.
Frequently asked questions
Do SSL certificates cost extra?
Certificates from Edge Proxy are free on every plan, and we renew them for you. A wildcard certificate and an upload of your own certificate come with Pro and the plans above it.
How do you check that a name is mine?
Before a certificate authority issues a certificate, it checks that you control the name. We add a TXT record to your zone when we host its DNS, check a TXT record you add at another provider, or answer an HTTP request when the name points at our network.
When do you renew a certificate?
We check every day and renew a certificate when 30 days are left. A certificate that you proved with a TXT record of your own does not renew by itself, so move the domain’s DNS to Coritan or use HTTP validation for one that should.
What does a wildcard certificate cover?
Every name directly under the domain, such as www.example.com and shop.example.com for *.example.com. It does not cover example.com itself or a name two levels down such as a.b.example.com. The domain’s DNS must be on Coritan, and wildcard certificates come with Pro and up.
Can I use a certificate I bought elsewhere?
From Pro, you can upload it on the SSL/TLS tab, and it replaces the free certificate on that name. We do not renew it. About 30 days before it expires, we replace it with a free certificate unless you have uploaded a newer one.
Is there a limit on new certificates?
Certificate authorities limit how many certificates they issue for one registered domain in a week, so we limit it too: up to 45 from the first authority and 90 from each of the other two. At the limit we refuse new orders until older certificates leave the seven-day window.
