KLYRN
Install Free

    All documentation
    1. Home
    2. Docs
    3. SSL

    SSL

    Certificates are issued when a site is created and renewed 30 days before they expire. You do not schedule it, and there is nothing to remember.

    Issuing

    Creating a site requests a Let's Encrypt certificate over HTTP-01. Before ordering, KLYRN resolves every name the site answers for and orders only the ones that point at this server: the apex, www if www handling is on, and every alias and redirect that resolves here.

    That is why a certificate succeeds for a site whose www record has not been created yet, instead of failing outright. The names that were left off are added at the next issue. 

    klyrn site ssl example.com     # issue or renew now
klyrn site show example.com    # the certificate, its names and its expiry

    Before DNS points here

    If nothing resolves to this server yet, the site is created and served over HTTP, and the certificate is retried by the scheduler. The scheduler's first pass is 90 seconds after klyrn-core starts and then every ten minutes, so a certificate normally appears within minutes of the record propagating.

    The message you get is the specific one: what the name resolves to now, what this server's address is, and that a record has to change. It is never "certificate failed".

    Renewal

    The same scheduler renews any certificate within 30 days of expiry. Two things make that reliable rather than nominal:

    • A renewed certificate forces an nginx reload. A vhost that is byte for byte identical does not trigger one on its own, and a server that keeps presenting the old certificate until it expires is a specific bug we have had and fixed.
    • The health engine watches expiry independently. The certificates check runs every six hours and warns under 14 days with the wording "renewal is automatic, this means renewal has been failing", because at that point it has been.

    What is not supported

    Said plainly rather than left to be discovered:

    Wildcard certificates
    Not issued. They require DNS-01, which KLYRN does not do yet.
    Uploading your own certificate
    Not supported. Let's Encrypt only.
    Other ACME providers
    Not configurable.

    The panel's own certificate is separate from the sites' and follows the same rules once it has a hostname. See First setup.