SSL

Issuing

Creating a site requests a Let's Encrypt certificate over HTTP-01. Before ordering, KLYRN resolves every name the site answers for and orders only the ones that point at this server. That means the apex, www if www handling is on, and every alias and redirect that resolves here.

A site whose www record has not been created yet still gets its certificate. The names that were left off are added at the next issue.

klyrn site ssl example.com     # issue or renew now
klyrn site show example.com    # the certificate, its names and its expiry

Before DNS points here

If nothing resolves to this server yet, the site is created and served over HTTP, and the scheduler retries the certificate. Its first pass is 90 seconds after klyrn-core starts, then every ten minutes. A certificate normally appears within minutes of the record propagating.

The message says what the name resolves to now, what this server's address is, and that a record has to change.

Renewal

The same scheduler renews any certificate within 30 days of expiry.

• A renewed certificate forces an nginx reload. A vhost that is byte for byte identical does not trigger one on its own.
• The health engine watches expiry independently. The certificates check runs every six hours and warns under 14 days with the wording "renewal is automatic, this means renewal has been failing".

What is not supported

Wildcard certificates

Issued through DNS-01, which needs a zone KLYRN can write: a connected provider or this server as the nameserver.

Uploading your own certificate

Supported. KLYRN cannot renew an uploaded certificate. It reminds you before it expires.

Other ACME providers

Not configurable.

The panel's own certificate is separate from the sites' and follows the same rules once it has a hostname. See First setup.