How SSL/TLS certificates work

Coritan gets SSL/TLS certificates from public certificate authorities and installs them at the edge, so visitors reach your web proxies over HTTPS. A certificate you request covers one name, such as example.com or www.example.com. Coritan does not charge for certificates, and it renews them before they expire.

Coritan orders certificates with the ACME protocol. It asks Let's Encrypt first, then ZeroSSL, then Google Trust Services. It moves to the next authority when one refuses the order or has no allowance left for the domain that week. It does not move on when validation fails, because every authority checks the same proof.

The Issuer row on the Certificate card names the authority that issued a certificate. If the domain publishes CAA records, they must allow all three authorities (DNS record types).

Before an authority issues a certificate, it checks that you control the name. The SSL tab offers three ways to prove it:

Coritan DNS (automatic)

Coritan adds a TXT record named _acme-challenge to the zone, waits until its nameservers serve it, and deletes it after validation. You do nothing. It needs a zone that Coritan hosts, with the domain's nameservers set to Coritan's. This is DNS-01 validation.

Manual DNS TXT record

For a domain whose DNS is at another provider. You add the _acme-challenge TXT record there, with a value that Coritan shows you. This is DNS-01 validation too.

HTTP validation

The name must resolve to the Coritan edge. The authority fetches a file from http://example.com/.well-known/acme-challenge/, and the edge answers it. This is HTTP-01 validation.

A fourth choice, Let Coritan choose, picks HTTP validation when the name has a web proxy, Coritan DNS when Coritan hosts the zone, and HTTP validation otherwise. When HTTP validation fails and Coritan hosts the zone, Coritan tries again with Coritan DNS.

The Challenge row on the Certificate card shows how a certificate was validated: DNS-01, DNS-01, manual or HTTP-01.

The edge serves a certificate for a name that has a web proxy. A new web proxy requests its own certificate while Request a certificate automatically is on, which it is by default. A certificate issued for a name with no web proxy stays on your account, and Coritan uses it when a web proxy for the name requests a certificate.

Without a certificate, the edge answers HTTPS for the name with a certificate for another name, and browsers warn visitors.

When you claim a free coritan.gg name, Coritan requests a wildcard certificate for it, such as *.survival-smp.coritan.gg. The wildcard covers the name and every name directly under it, and the SSL tab says so when it is the certificate in use. You cannot request a wildcard certificate for any other name. When the one for a coritan.gg name was not requested, or you need it again, request it again through the API.

pending

Coritan has ordered the certificate, and the authority is validating the name.

active

Issued and in use. The Expires row shows when it runs out.

failed

The last order or renewal failed, and The last request failed on the Certificate card gives the reason. A certificate that failed to renew stays in use at the edge until it expires.

expired

Past its expiry date, or replaced by a newer certificate for the same name.

revoked

You revoked it, and Coritan no longer serves it.

Coritan checks certificates every day and renews an active certificate once it has 30 days or less left. It renews with the method the certificate was validated with, so that proof must still work: the zone must still be at Coritan for Coritan DNS, and the name must still resolve to the edge for HTTP validation.

A certificate validated with Manual DNS TXT record needs a new TXT value at each renewal, and Coritan cannot add it for you, so its automatic renewal fails. For a certificate that renews on its own, move the domain's DNS to Coritan or use HTTP validation. Renew or revoke a certificate covers renewing by hand.

Certificate authorities limit how many certificates they issue for one registered domain in a week, so Coritan limits it too. The count covers every certificate for names under the registered domain, such as example.com for www.example.com. The Issuance limit card on the SSL tab shows how many certificates were issued in the last seven days, out of the limit. At the limit, Coritan refuses new orders until older certificates leave the seven-day window.

List the certificates for the zones and registered domains on your account, newest first. per_page takes up to 100 and defaults to 25:

curl "https://api.coritan.com/api/v1/ssl/certificates?page=1&per_page=25" \
  -H "Authorization: Bearer $CORITAN_TOKEN"

The answer is {"certificates": [...], "total": 3}, and the list includes certificates in every status.

Read the certificate that secures one name, with the issuance count for its registered domain:

curl https://api.coritan.com/api/v1/ssl/certificates/example.com/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "domain": "example.com",
  "has_certificate": true,
  "certificate": {
    "id": 118,
    "domain": "example.com",
    "route_id": 31,
    "zone_id": 42,
    "status": "active",
    "issuer": "letsencrypt",
    "challenge_method": "dns01",
    "issued_at": "2026-09-01T02:14:09",
    "expires_at": "2026-11-30T01:14:08",
    "last_renewal_at": "2026-09-01T02:14:09",
    "renewal_attempts": 0,
    "error_message": null,
    "created_at": "2026-09-01T02:12:51",
    "san_domains": [],
    "serial": null,
    "fingerprint_sha256": null,
    "requested_provider": null,
    "failover_from": []
  },
  "rate_limit": {
    "registered_domain": "example.com",
    "issued_last_7_days": 1,
    "limit": 45,
    "remaining": 44,
    "allowed": true
  },
  "wildcard": false
}

certificate is the newest certificate for the name. When the name has none, it is a wildcard that covers the name and wildcard is true, or null when nothing covers it. has_certificate is true only when that certificate is active.

issuer is letsencrypt, zerossl or google_trust_services, and challenge_method is dns01, dns01_manual or http01. renewal_attempts counts the failed attempts recorded for the certificate. This endpoint and the list leave san_domains, serial, fingerprint_sha256, requested_provider and failover_from empty.

• Issue an SSL/TLS certificate
• Renew or revoke a certificate
• How web proxies work