Skip to main content

​
Renewal

Certificates the platform issued are renewed automatically, starting 30 days before expires_at. The window is deliberately wide: it leaves room for many attempts before anything actually expires, so a transient DNS or authority problem is not an outage. Renewal reuses the existing challenge delegation, so a CNAME you published once keeps working. When a certificate is reissued its fingerprint changes — that is the signal to anything holding the material that there is a new generation to pick up. A renewal that fails is retried, but not immediately: a certificate whose last attempt was under six hours ago is skipped, so a stuck CNAME or an authority having a bad day is retried on a sensible cadence rather than on every pass.
Uploaded certificates are excluded from renewal. See Uploading your own certificate.

​
Revoking

Open your certificate, then choose Settings. In Danger zone, click Revoke certificate and type the certificate name to confirm. Only active or expired certificates can be revoked.The page shows Revocation requested while checking for completion. The certificate status stays unchanged until revocation completes. If completion cannot be confirmed, use Check status to resume checking. Deletion stays unavailable while completion is unconfirmed. Leaving or reloading the page stops tracking; check the status when you return.
Revocation cannot be undone. Deleting removes the certificate from your account, while revoking asks the issuing authority to mark it invalid so clients that check revocation stop trusting it. If the private key may have leaked, revoke — deleting alone leaves a certificate that still validates.
Revocation is asynchronous: the call returns 202 with the certificate still in its previous state, and you poll until status is revoked. An uploaded certificate is revoked locally, without contacting an authority. Contact its issuing authority separately to invalidate it for external clients. Revoking something already revoked is a no-op, not an error.

​
Statuses

​
Deleting

You cannot delete a certificate while it is the default of any load balancer listener. The API returns 409 Conflict. Select another default_certificate on each affected listener, or delete those listeners, then retry deletion.