SSL

Free Let's Encrypt certificates, renewals and custom certificates.

Guides

Get a free Let's Encrypt certificateIssue a free HTTPS certificate for a site with HTTP or DNS validation, understand how renewal works, force HTTPS and fix a certificate that failed.Force HTTPS and HSTSRedirect every visitor from HTTP to HTTPS, understand the Strict-Transport-Security header SrvYard adds, test the result and switch it off safely if something breaks.Wildcard certificates with DNS validationConnect Cloudflare once, then issue one Let's Encrypt certificate that covers every subdomain of your domain, or a certificate for a site that is not online yet.Install a custom certificateInstall a certificate you bought or received from your own authority, create a signing request so the private key never leaves SrvYard, and know how to renew it by hand.How renewals work and what to do when one failsWhen SrvYard renews a certificate, when it emails you, how failed requests are retried, and the exact steps to take when a renewal does not go through.

Frequently asked

Are certificates free, and do they renew by themselves?

Yes. SrvYard gets Let's Encrypt certificates for you. They last 90 days and SrvYard renews them before they expire, emailing owners and admins if a renewal does not go through. See Get a free Let's Encrypt certificate and How renewals work.

Why did my certificate request fail?

Nearly always outside SrvYard: the domain's A record does not point at the server yet, port 80 is closed or redirected, or Let's Encrypt has asked you to wait. SrvYard checks the DNS records first and names the culprit. See Find out why a certificate failed.

Can I get a wildcard certificate?

Yes, with DNS validation. SrvYard adds a temporary TXT record in Cloudflare, so the domain's DNS must be hosted there. HTTP validation cannot issue wildcards. See Wildcard certificates with DNS validation and Connect Cloudflare.

Does a custom certificate renew automatically?

No. SrvYard cannot ask your authority for a new one, so you replace it by hand before it expires. The key must be in PEM format without a passphrase. See Install a custom certificate.

What does Force HTTPS do, and why do I get too many redirects?

It redirects every HTTP request to HTTPS and adds an HSTS header. Too many redirects usually mean a proxy such as Cloudflare in Flexible mode talks to the server over HTTP. Make it connect over HTTPS. See Force HTTPS and HSTS.

I added a domain to a site that already has a certificate. Is it covered?

Not yet. The new name is not on the existing certificate, so request a certificate again with the new name ticked. Until you do, visitors to that name see a certificate warning. See Get a free Let's Encrypt certificate.

Does the free srvy.sh address get a certificate automatically?

Yes. SrvYard waits, for up to about ten minutes, until the name resolves to your server and then requests the certificate itself. You only need the article for your own domains, wildcards, or when that automatic request failed. See Get a free Let's Encrypt certificate.