HTTPS certificates
When a lab publishes a domain, the platform gets a free certificate for it and renews it before it expires. You never request one yourself. This page explains how certificates work and what to check when something looks wrong.
How it works
- A certificate is requested when a lab exposes a domain — on the deploy that attaches it. A domain you own but no lab serves has no certificate, and that is normal.
- All domains exposed on one port share a single certificate. This means the number of certificates will not match the number of domains you own.
- Platform subdomains are validated through DNS, which the platform controls. They are issued without any action from you.
- Custom domains are validated by connecting to your domain, so its A record must point at the platform — both when the certificate is issued and every time it renews.
- Certificates are renewed automatically well before they expire.
Open the SSL Manager
The SSL Manager has no sidebar entry. Go to Connectivity → My Domains and select the SSL badge on any domain card.
The header has three buttons:
| Button | What it does |
|---|---|
| Troubleshoot | Checks every certificate and lists the findings by severity, each with a fix |
| Refresh | Gets the latest state. Certificate data is cached for up to 15 minutes. |
| ? (How does SSL work here?) | Shows a short explanation, including the address that custom domains must point at |
Refresh and Troubleshoot share one allowance of three runs every ten minutes. After that, you see Please wait a few minutes between troubleshoot runs.
What Troubleshoot shows
If nothing is wrong, it says No problems found and how many certificates it checked. Otherwise it lists each finding with a severity badge — high (blocking renewal), medium or info. Each finding shows the certificate it concerns, what is wrong, when the last error happened, and a Fix line that tells you what to do.
Reading a certificate card
Type
| Badge | Meaning |
|---|---|
| selfmade | Covers platform subdomains |
| custom | Covers your own domains |
| auto (vs code / proxy), auto (service) | Managed entirely by the platform for editor and app links. While healthy, these are hidden under Show N auto-managed certificate(s). |
| pending issue | Requested, not issued yet |
Status
| Status | Meaning | Action |
|---|---|---|
| valid | Healthy | None |
| expiring soon | It expires within 30 days. Renewal is due and normally happens automatically. | None, unless it stays like this for days |
| not issued yet | The domain is exposed but has no certificate yet — it is requested on the next redeploy | Redeploy the lab |
| issuance failing | The first certificate could not be obtained | Run Troubleshoot |
| renewal failing | A renewal attempt failed in the last 14 days; it will expire if nothing changes | Run Troubleshoot, fix, then request a re-issue |
| expired | Visitors see a security warning | Fix the cause, then request a re-issue |
Usage
| Badge | Meaning |
|---|---|
| in use · lab | Served by that lab |
| orphaned | No active lab uses it |
| stale — auto-clean | An old certificate that the platform removes by itself. No action is needed. |
| blocked | Renewal is blocked by one of the domains in it (below) |
The card also shows the domains it covers, the expiry date and the last error.
| Field | Meaning |
|---|---|
| Resolver | How the certificate is validated — through DNS for platform subdomains, or by connecting to the domain for custom ones |
| SANs | The names the certificate covers. The first three are shown, then +N more. |
| Expires | The expiry date and how many days are left, or not issued |
| Last error | The start of the most recent error, when there is one |
| deletion requested | A re-issue request is open. Hover it to see its state. |
View Details
View Details lists every domain in the certificate, what it points to, and its renewal state — renewable, auto (DNS), or blocker. A blocker is a domain that stops the whole certificate from renewing.
It also shows when the certificate was issued and when it expires (in UTC), which lab is using it, and the full text of the last renewal error.
Fix a failing certificate
- Select Troubleshoot and read the finding for that certificate.
- Fix what it names. It is almost always one of these:
- a custom domain whose A record no longer points at the platform — fix the record at your DNS provider;
- a dead domain still attached to the lab — remove it in the lab's Preferences and redeploy without it.
- Open the certificate's menu and choose Request Re-issue.
Re-issue requests are reviewed by an administrator before they run. While you wait, the card shows a deletion requested badge. Cancel Request withdraws the request.
The re-issue request, step by step
- Where
- Dashboard, Connectivity, My Domains, SSL badge, a certificate card's menu, Request Re-issue
- What it shows
- The Request Certificate Re-issue dialog after the check, showing either the 'clean to re-issue' message with the Request Re-issue button, or the list of blocking domains.
- Choose Request Re-issue in the certificate's menu. The dialog first checks whether the certificate is clean to re-issue.
- If it is, the dialog says so. Select Request Re-issue to send it. You see Request Submitted and the card gets a deletion requested badge.
- An administrator reviews it. Before approving, the platform checks the certificate again; if the cause has come back, the request is closed without being applied.
- Once it is approved and applied, the old certificate is deleted and a new one is obtained automatically. The badge disappears and the card shows the new certificate after a Refresh.
| Request state (hover the badge) | Meaning |
|---|---|
| pending | Waiting for an administrator. You can still cancel it. |
| approved, applying | Accepted and being carried out |
If a request is rejected, canceled or no longer eligible, the badge disappears and the certificate stays as it was. Fix any remaining cause and request again.
Cancel Request appears only while the request is pending. It asks for confirmation — Keep Request leaves it open.
You can send up to 5 re-issue requests a day, and have up to 10 open at once.
Certificate authorities limit how many certificates can be issued for a name in a given period. Repeated failed attempts can lock a domain out for days, so each re-issue is checked first.
When Request Re-issue is refused
Request Re-issue is only offered on expired and renewal failing certificates. A request is refused before it reaches an administrator when:
| Reason | What to do |
|---|---|
| The certificate is healthy | Nothing — only failing ones can be re-issued |
| A domain is not pointing at the platform | Fix its A record first |
| A domain that is not yours is still routed to the lab | Remove it and redeploy |
| It is a platform domain | Platform certificates are handled automatically |
| A request is already open | Wait for it, or cancel it |
The refusal lists the blocking domains so you know exactly what to fix.
Do it with an AI assistant
You can also do this by asking an AI assistant connected to your account — see Connect an AI assistant to set one up.
| Ask | What the assistant does |
|---|---|
| “Why does my site say Not Secure?” | ssl_troubleshoot, and explains the fix for each finding |
| “When do my certificates expire?” | list_ssl_certificates |
| “Ask for the broken certificate to be re-issued” | ssl_troubleshoot to find it, then request_ssl_reissue |
| “Cancel that request” | cancel_ssl_request |
An administrator reviews and applies re-issue requests, and a request for a healthy certificate is refused. You can run the troubleshooter only a few times every ten minutes, and a DNS fix is picked up at the platform's next check. Give it time instead of asking again right away.
Next
- Domains — adding and attaching domains
- HTTPS not secure — symptom-first fixes