Renew or revoke a certificate

Coritan renews certificates on its own once they have 30 days or less left (How SSL/TLS certificates work). Renew one yourself when it is close to expiry and has not renewed, or when you want a new one early. Revoke a certificate to stop Coritan serving it.

• The certificate must be active. The Renewal card, with Renew now and Revoke certificate…, appears only for an active certificate.
• A renewal validates the same way the certificate was first validated. For Coritan DNS the zone must still be at Coritan, and for HTTP validation the name must still resolve to the edge.

1. In the dashboard, go to Websites, open the domain and select the SSL tab.
2. On the Renewal card, select Renew now.

For a name without an SSL tab, such as www.example.com, go to Edge Proxy, open its web proxy and select Renew now on the Certificate card of the Overview tab.

1. In the dashboard, go to Websites, open the domain and select the SSL tab.
2. On the Renewal card, open the More certificate actions menu and select Revoke certificate….
3. Type the domain, such as example.com, to confirm.
4. Select Revoke certificate.

After Renew now, the dashboard confirms Renewal of the certificate for example.com started. Once the certificate authority issues the new certificate, the Expires row moves forward, Last renewal shows the date, and the web proxy serves the new certificate.

After you revoke a certificate, the dashboard confirms Certificate for example.com revoked. and the certificate shows revoked. Coritan stops serving it, but it does not ask the certificate authority to revoke it. To serve HTTPS again, request a certificate from the web proxy.

The certificate shows failed after a renewal

The renewal did not validate. The previous certificate stays in use until its Expires date. Read the reason under The last request failed, fix it, and issue a new certificate before that date.

A certificate validated with a manual TXT record did not renew

Each renewal needs a new TXT value, which Coritan cannot add at another DNS provider, so the renewal fails and the certificate shows failed. Run the manual DNS validation again before the Expires date. To stop this happening, move the domain's DNS to Coritan or use HTTP validation.

A certificate is close to its Expires date and has not renewed

Select Renew now. If the renewal fails, the Certificate card gives the reason.

The SSL tab offers no way to request a certificate after you revoked one

The tab keeps showing the revoked certificate. Select Request certificate on the web proxy's Overview tab in Edge Proxy, or order one with the API.

No active certificate found for this domain

Only an active certificate can be renewed. Issue a new certificate instead.

Renewal already in progress

Coritan is already renewing the certificate. Wait for the Certificate card to update.

• How SSL/TLS certificates work
• Issue an SSL/TLS certificate

Renew an active certificate by its name. The answer is 202:

curl -X POST https://api.coritan.com/api/v1/ssl/certificates/example.com/renew \
  -H "Authorization: Bearer $CORITAN_TOKEN"

{
  "message": "Certificate renewal queued",
  "job_id": 5814,
  "domain": "example.com"
}

Revoke it. The answer is 200 with {"message": "Certificate revoked", "domain": "example.com"}, or 404 with No active certificate found when the name has no active certificate:

curl -X DELETE https://api.coritan.com/api/v1/ssl/certificates/example.com \
  -H "Authorization: Bearer $CORITAN_TOKEN"

To serve HTTPS again, order a new certificate with POST /api/v1/ssl/certificates (Issue an SSL/TLS certificate).