HTTPS certificates
When a lab publishes a domain, the platform gets a free certificate for it and renews it before it expires. You never request one by hand. This page explains what to check when something looks wrong.
How it works
- A certificate is requested when a lab exposes a domain — on the deploy that attaches it. A domain you own but no lab serves has no certificate, and that is normal.
- All domains exposed on one port share a single certificate. So the number of certificates will not match the number of domains you own.
- Platform subdomains are validated through DNS, which the platform controls. They issue without any action from you.
- Custom domains are validated by connecting to your domain, so its A record must point at the labs — both when the certificate is issued and every time it renews.
- Certificates are renewed automatically well before they expire.
Open the SSL Manager
The SSL Manager has no sidebar entry. Go to Connectivity → My Domains and click the SSL badge on any domain card.
The header has three buttons:
| Button | What it does |
|---|---|
| Troubleshoot | Checks every certificate and lists findings by severity, each with a fix |
| Refresh | Fetches the latest state. Certificate data is cached for up to 15 minutes. |
| ? (How does SSL work here?) | A short explanation, including the address custom domains must point at |
Reading a certificate card
Type
| Badge | Meaning |
|---|---|
| selfmade | Covers platform subdomains |
| custom | Covers your own domains |
| auto (vs code / proxy), auto (service) | Managed entirely by the platform for editor and app links. Hidden under Show N auto-managed certificate(s) while healthy. |
| pending issue | Requested, not issued yet |
Status
| Status | Meaning | Action |
|---|---|---|
| valid | Healthy | None |
| expires in Nd / expiring soon | Renewal is due; it normally happens automatically | None, unless it stays like this for days |
| not issued yet | The domain is exposed but has no certificate yet — it is requested on the next redeploy | Redeploy the lab |
| issuance failing | The first certificate could not be obtained | Run Troubleshoot |
| renewal failing | Renewal keeps failing; it will expire if nothing changes | Run Troubleshoot, fix, then request a re-issue |
| expired | Visitors see a security warning | Fix the cause, then request a re-issue |
Usage
| Badge | Meaning |
|---|---|
| in use · lab | Served by that lab |
| orphaned | No active lab uses it |
| stale — auto-clean | An old certificate the platform will remove itself. No action needed. |
| blocked | Renewal is blocked by one of the domains in it (below) |
The card also shows the domains it covers, the expiry date and the last error.
View Details
View Details lists every domain in the certificate, what it points to, and its renewal state — renewable, auto (DNS), or blocker. A blocker is the domain stopping the whole certificate from renewing.
Fix a failing certificate
- Click Troubleshoot and read the finding for that certificate.
- Fix what it names. Almost always one of:
- a custom domain whose A record no longer points at the labs — fix the record at your DNS provider;
- a dead domain still attached to the lab — remove it in the lab's Preferences and redeploy without it.
- Open the certificate's menu and choose Request Re-issue.
Re-issue requests are reviewed by an administrator before they run. The card shows a pending badge meanwhile, and Cancel Request withdraws it.
Certificate authorities limit how many certificates can be issued for a name in a given period. Repeated failed attempts can lock a domain out for days, so each re-issue is checked first.
When Request Re-issue is refused
Request Re-issue is only offered on expired and renewal failing certificates. A request is refused before it reaches an administrator when:
| Reason | What to do |
|---|---|
| The certificate is healthy | Nothing — only failing ones can be re-issued |
| A domain is not pointing to the labs | Fix its A record first |
| A domain that is not yours is still routed to the lab | Remove it and redeploy |
| It is a platform domain | Platform certificates are handled automatically |
| A request is already open | Wait for it, or cancel it |
The refusal lists the blocking domains so you know exactly what to fix.
Do it with an AI assistant
You can also do this by asking an AI assistant connected to your account — see Connect an AI assistant to set one up.
| Ask | What the assistant does |
|---|---|
| “Why does my site say Not Secure?” | ssl_troubleshoot, and explains the fix for each finding |
| “When do my certificates expire?” | list_ssl_certificates |
| “Ask for the broken certificate to be re-issued” | ssl_troubleshoot to find it, then request_ssl_reissue |
| “Cancel that request” | cancel_ssl_request |
An administrator reviews and applies re-issue requests, and a healthy certificate is refused. The troubleshooter can be run only a few times every ten minutes, and a DNS fix is picked up on the platform's next check — so give it time rather than asking again straight away.
Next
- Domains — adding and attaching domains
- HTTPS not secure — symptom-first fixes