Certificate Settings

Certificate entries have the following settings:

Name:

A short name for the certificate

Description:

A longer string describing the certificate

Status:

Whether or not this entry is active

Active:

This entry will be processed manually and by the Cron job (General Settings)

Disabled:

This entry will be ignored

Acme Account:

The account key ACME will use when requesting the certificate (see Generate an Account Key)

Private Key:

The key length of the private key for this certificate. May be either RSA or ECDSA in several pre-defined sizes. Select Custom to manually enter a private key generated elsewhere

2048-bit RSA is an acceptable default choice, but larger keys are more secure

OCSP Must Staple:

When set, ACME will configure the certificate request for OCSP Stapling

Warning

Do not enable this option unless all consumers of the certificate support OCSP Stapling.

Domain SAN List:

A list of all domain names which will be included in this certificate as Subject Alternative Name (SAN) entries.

Note

A certificate can contain up to 100 SAN entries, and they can use the same or different update methods. Each SAN must be individually validated by Let’s Encrypt before a certificate will be issued.

Mode:

Whether or not this SAN is active in the certificate

Domain Name:

The domain name for a SAN entry in this certificate (e.g. www.example.com)

Method:

The method used by ACME to validate ownership of this domain. Method settings are described in (Validation Methods)

Click Add for additional SAN entries

DNS Providers also have some common settings which appear for all types:

DNS Alias:

An alternative domain name used by the validation process. Instead of updating the DNS record for Domain Name directly, the package uses this domain name is used instead. See DNS Alias Mode for details.

DNS Alias Mode:

When set, controls whether or not the DNS alias mode used is Challenge Alias (Unchecked, Default) or Domain Alias (Checked). See DNS Alias Mode for details.

DNS-Sleep:

The amount of time the ACME validation process will wait after making DNS changes before attempting to validate. Some DNS services take a few minutes to propagate entries after making backend changes.

The default settings are typically sufficient, but slower providers may require a longer sleep time.

Actions List:

Commands to run after the package renews a certificate.

Mode:

Whether or not this action is active

Command:

Full path to command and arguments, service name, or name of script

Method:

Defines how the Command is executed by the package

Shell Command:

The Command is a full path to a shell command and its arguments

PHP Command Script:

The Command value is run as PHP code

Restart Local Service:

The name of a local service to restart

Restart Remote Service:

The name of a remote service to restart via XMLRPC. This utilizes the system XMLRPC sync configuration

The GUI includes several examples of common actions

Certificate Renewal After:

When the package will attempt a renewal for the certificate. Default is 60 days (2 months). Certificates are valid for a maximum of 90 days.