Help center

A TLS certificate is like a digital ID card your server shows to every visitor's browser. That ID card has to name exactly which website address (or addresses) it's valid for - that's what this step collects.

Your primary domain is the main address, e.g. example.com. It becomes the certificate's “Common Name.”

Additional hostnames (technically “Subject Alternative Names,” or SANs) are other addresses the same certificate should also cover - for example www.example.com or api.example.com. This is useful when several subdomains sit behind the same server or load balancer, so you don't need a separate certificate for each one.

The internal label is just a private note for your own records (like “prod-lb-01”) - it's never included in the certificate and nobody but you sees it.

One thing to know ahead of time: whatever domains you list here must exactly match the names inside your CSR in the next step. If they don't, you'll get a clear message telling you what to fix before you can continue.

Generating a CSR creates two mathematically linked keys: a private key that never leaves your computer or server, and a public key that gets bundled into the CSR you send us, along with your domain names.

Think of the private key as a physical key you keep in your pocket, and the CSR as a request that includes the matching lock (your public key) plus your details. We check the request, confirm you actually control the domain, and hand back a signed certificate for that lock. The certificate only works paired with the private key you kept - even though the certificate itself is public information (visible to anyone, including in public Certificate Transparency logs), nobody else can use it without your private key.

You have two options on this step: paste an existing CSR if your infrastructure already generates them (Kubernetes cert-manager, a load balancer, your own ACME client, etc.), or generate a new one using the OpenSSL command we show you, run locally so the private key never touches our servers.

When you paste a CSR, we check: the domain names inside it match what you entered in the Domains step, and the key is strong enough (RSA 2048-bit or larger, or a standard elliptic curve like P-256/P-384/P-521). Weak or outdated keys are rejected with a specific reason so you know exactly what to regenerate.

A certificate is nothing exotic - just a small file (the .pem you'll download once this step finishes) that your server hands to every visitor's browser as proof of who it is.

Before any certificate can be issued, we need proof you actually control the domain - otherwise anyone could request a certificate for a website they don't own. You choose one of two ways to prove it:

• DNS validation - add a specific text (TXT) record to your domain's DNS settings. Only someone with access to your DNS panel could add that record, which is what proves control.
• HTTP validation - place a specific file at a specific address on your web server. Only someone with access to the server hosting that domain could do that.

After you place the order, it moves through a few stages you can watch live on the Order status page: order created → payment authorized → awaiting validation → processing → issued (or one of a few failure states, each with a clear recovery action). Validation typically finishes within a couple of minutes.

Choosing a duration (7 to 200 days) sets how long the certificate stays valid. Once that period elapses, browsers stop trusting it - there's no automatic renewal yet, so you'll need to place a fresh order before then. Shorter durations mean more frequent reordering but a smaller window of exposure if a certificate or key were ever compromised.

Once issued, “download” gives you a .pem file containing the full certificate chain, not just the leaf - there's no separate intermediate certificate to track down. Install it as-is on whatever serves your website (nginx, Apache, a load balancer, etc.) alongside the private key you generated in the CSR step.

Once it's installed, you can confirm it took effect from a terminal:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null

Look for Verify return code: 0 (ok) near the bottom of the output - that means the chain checks out. A non-zero code usually means the install is incomplete, or the server is still serving an old certificate.