Issue an SSL/TLS certificate

Issue a certificate for a website on its SSL tab. You choose how to prove that you control the name, and Coritan installs the certificate on the name's web proxy once the certificate authority issues it. A new web proxy requests its own certificate, so you need these steps for a name that has none, or one whose certificate failed or expired. How SSL/TLS certificates work explains the validation methods.

• The domain must be on your Websites list: a zone that Coritan hosts, or a domain registered with Coritan.
• If the domain publishes CAA records, they must allow Let's Encrypt, ZeroSSL and Google Trust Services (DNS record types).
• The SSL tab shows the Request a certificate card when the name has no certificate, or when its certificate is failed or expired.
• The SSL tab covers the website's own name, such as example.com. For another name with a web proxy, such as www.example.com, request the certificate from the web proxy.

Use this method when Coritan hosts the zone and the domain uses Coritan's nameservers. The dashboard selects it for you in that case.

1. In the dashboard, go to Websites, open the domain and select the SSL tab.
2. On the Request a certificate card, select Coritan DNS (automatic).
3. In Install on proxy route, keep the website's web proxy, or choose Zone only to keep the certificate without installing it.
4. Select Start validation. The card shows Nothing to do.
5. Select Issue certificate.

Use this method when the domain's DNS is at another provider and the name does not resolve to the Coritan edge. You create the record first with any value, then replace the value once Coritan has ordered the certificate.

1. In the dashboard, go to Websites, open the domain and select the SSL tab.
2. On the Request a certificate card, select Manual DNS TXT record, then Start validation. The card lists a TXT record named _acme-challenge.example.com with a TTL of 60, and its value is still empty.
3. At your DNS provider, create a TXT record at _acme-challenge.example.com with any value, such as pending.
4. Wait until the badge reads TXT record found, value differs, or select Check now.
5. Select Complete validation. The card shows Issuing the certificate.
6. After a few seconds, reload the page. The card shows the TXT record again, now with its value.
7. At your DNS provider, replace the record's value with the one shown. Do it within five minutes of step 5, because Coritan checks for the value for five minutes.

When public resolvers return the new value, the badge reads TXT record found and the certificate authority issues the certificate. You do not need to select Complete validation again. Delete the TXT record once the certificate is active.

Use this method when the name resolves to the Coritan edge, or when you can point it there.

1. In the dashboard, go to Websites, open the domain and select the SSL tab.
2. On the Request a certificate card, select HTTP validation, then Start validation. The card lists an A record for the name with the edge address as its value, and the addresses the name resolves to now.
3. If the badge reads Not pointed at the edge, set the name's A record to the address shown at the DNS provider that answers for the domain.
4. Wait until the badge reads Ready. The card checks every few seconds, and Check now checks at once.
5. Select Complete validation. It stays unavailable until the name resolves to the edge address.

Keep the name pointed at the edge after the certificate is issued. Renewal validates the same way.

A web proxy's Overview tab has its own Certificate card. Use it for a name that has no SSL tab, such as www.example.com.

1. In the dashboard, go to Edge Proxy and open the web proxy.
2. On the Overview tab, find the Certificate card and select Request certificate. The button appears when the proxy has no active certificate and none is being issued.

The card shows Issuance in progress while the certificate authority validates the name. Coritan uses a certificate that already covers the name when there is one. Otherwise it validates over HTTP, so the name must resolve to the edge, and it falls back to Coritan DNS when Coritan hosts the zone.

The dashboard confirms Certificate issuance for example.com started. The Certificate card shows pending while the certificate authority validates the name, then active with the Issuer and Expires rows. The web proxy for the name serves the certificate. With Zone only, the certificate waits on your account until a web proxy for the name requests one.

This domain has reached its weekly issuance limit.

The registered domain is at its issuance limit, and Start validation is unavailable. Wait until the count on the Issuance limit card falls.

Rate limit: 45/45 certificates issued by all authorities for example.com in the past 7 days

The same limit, reported when you start validation. Wait until older certificates leave the seven-day window.

You must own this domain via registration, DNS zone, or proxy route

The name is not on your account. Add its zone first (Add a domain you already own).

No TXT record found at _acme-challenge.example.com. Please add the record and try again.

Public resolvers do not return a TXT record at that name yet. Check the record's name at your DNS provider, wait for it to appear, and select Complete validation again.

Domain does not resolve to this server (203.0.113.10). Current IPs: none. Update your A record and try again.

The name does not resolve to the edge address. Set its A record to the address in the message and try again once the change has spread.

Certificate issuance already in progress

Coritan is already issuing a certificate for the name. Wait for the Certificate card to show the result.

The last request failed mentions DNS verification failed

Coritan did not see the TXT value within five minutes. Start again with Manual DNS TXT record, and replace the value as soon as it appears.

The last request failed mentions HTTP verification failed

Coritan could not fetch the validation file from the name over HTTP. Check that the name resolves only to the edge address and that port 80 reaches the edge. Then start again.

The last request failed mentions CAA

A CAA record for the domain does not allow the certificate authorities that Coritan uses. Add an issue record for each one, then start again.

• How SSL/TLS certificates work
• Renew or revoke a certificate
• Create a web proxy

The SSL tab runs a challenge in three calls: start it, read its status, then complete it. Start a challenge with a method of auto (the default), dns_automatic, dns_manual or http:

curl -X POST https://api.coritan.com/api/v1/ssl/challenges/start \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "method": "http"}'

The answer is 201 with what to do next. auto answers with the method it picked:

{
  "domain": "example.com",
  "method": "http",
  "status": "not_pointed",
  "txt_name": null,
  "txt_value": null,
  "expected_ip": "203.0.113.10",
  "current_ips": ["198.51.100.7"],
  "is_pointed": false,
  "instructions": "Point your domain's A record to 203.0.113.10, then call the /complete endpoint. Current resolution: 198.51.100.7",
  "created_at": "2026-09-25T10:00:00Z",
  "expires_at": "2026-09-25T11:00:00Z"
}

status is ready or not_pointed for http, and ready for dns_automatic. For dns_manual it starts as awaiting_order, with txt_name set and txt_value still null. Read it again with the status call. For a manual challenge the status is awaiting_record while there is no record, txt_found while the record holds another value, and verified once it holds txt_value. Without a manual challenge in progress, the call reports whether the name points at the edge:

curl https://api.coritan.com/api/v1/ssl/challenges/example.com/status \
  -H "Authorization: Bearer $CORITAN_TOKEN"

Complete an http or dns_manual challenge to order the certificate. The answer is 202:

curl -X POST https://api.coritan.com/api/v1/ssl/challenges/example.com/complete \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "message": "Certificate issuance started via HTTP verification",
  "job_id": 5812,
  "domain": "example.com"
}

For dns_manual the message is Certificate issuance started via manual DNS verification. Read the status again after a few seconds: txt_value now holds the value to publish.

A dns_automatic challenge has nothing to complete. Order the certificate directly instead, which is what Issue certificate does. challenge_method is dns01 or http01, and leaving it out lets Coritan choose. route_id installs the certificate on the web proxy with that ID, for the same name:

curl -X POST https://api.coritan.com/api/v1/ssl/certificates \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com", "challenge_method": "dns01", "route_id": 31}'

{
  "message": "Certificate issuance queued",
  "job_id": 5813,
  "domain": "example.com"
}

The call answers 403 with You must own the domain's DNS zone or domain registration for a name outside your zones and registered domains, and 404 with Route not found or access denied for a route_id that is not yours. Poll the certificate status until certificate.status is no longer pending.