---
title: "Let’s Encrypt® Certificates"
sidebar_label: "Let’s Encrypt® Certificates"
sidebar_position: 2
description: "How to issue a Let’s Encrypt® certificate with automatic renewal in the Certificate Manager, download it, and view its status"
---

import Formbricks from '@theme/MDXComponents/Formbricks'

import {CustomTable} from '@selectel/docux/components'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'

# Let’s Encrypt® Certificates

If you issue a Let’s Encrypt® certificate in the Certificate Manager, DNS-01 validation will occur automatically. The domain’s DNS records are stored in the Selectel infrastructure, so the service independently creates a TXT record to issue the certificate. The service will monitor the certificate expiration date and automatically renew it 30 days before it expires. If you issue the certificate yourself, you must confirm domain ownership and pass validation, and then renew the certificate every 60 days.

The certificate is only valid in the [project](/access-control/projects/about-projects.mdx) in which it was issued.

To issue a certificate, the domain must have an IP address in an A record.

## Issue a Let’s Encrypt® certificate \{#issue-lets-encrypt-certificate}

You can issue a Let’s Encrypt® certificate that will be valid:

* only for the primary domain or for the primary domain and all its subdomains (Wildcard certificate);
* only for a subdomain. The certificate will not be valid for the primary domain.

:::warning

After a Let’s Encrypt® certificate is issued, your site, service, or application will not automatically open over HTTPS — you need to [download the certificate](#download-lets-encrypt-certificate) and install it on your web server.

:::

<Tabs>
  <TabItem value="panel" default>
    <TabItemLabel>
      For primary domain and subdomains
    </TabItemLabel>

    1. [Create a zone](/dns-hosting/zones/create-zone.mdx) for the domain in DNS hosting.

    2. [Delegate the domain](/dns-hosting/zones/delegate-zone.mdx).

    3. In the [Control panel](https://my.selectel.ru/certificates/), on the top menu, click **Products** and select **Certificate Manager**.

    4. In the **Certificates** section, click **Add certificate**.

    5. Select **Certificates from Let’s Encrypt®**.

    6. Enter a name for the certificate.

    7. Select the domain you delegated to DNS hosting in step 2.

    8. Optional: to add a subdomain to the certificate for the primary domain, click **Add additional domain**.

       Enter the subdomain name. To issue a Wildcard certificate, enter a subdomain in the format `*.example.com`

    9. Click **Issue certificate**.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      Only for a subdomain
    </TabItemLabel>

    1. [Create a zone](/dns-hosting/zones/create-zone.mdx) for the subdomain in DNS hosting.
    2. [Delegate the subdomain](/dns-hosting/zones/delegate-zone.mdx).
    3. In the [Control panel](https://my.selectel.ru/certificates/), on the top menu, click **Products** and select **Certificate Manager**.
    4. In the **Certificates** section, click **Add certificate**.
    5. Select **Certificates from Let’s Encrypt®**.
    6. Enter a name for the certificate.
    7. Select the subdomain you delegated to DNS hosting in step 2.
    8. Click **Issue certificate**.
  </TabItem>
</Tabs>

## Download a Let’s Encrypt® certificate \{#download-lets-encrypt-certificate}

1. In the [Control panel](https://my.selectel.ru/certificates/), on the top menu, click **Products** and select **Certificate Manager**.
2. In the **Certificates** section, open the certificate page.
3. In the **Certificate files** block, select the certificate, intermediate certificate chain, root certificate, and private key.
4. Click **Download**.

## View the status of a Let’s Encrypt® certificate \{#view-lets-encrypt-certificate-status}

1. In the [Control panel](https://my.selectel.ru/certificates/), on the top menu, click **Products** and select **Certificate Manager**.
2. In the **Certificates** section, view the status in the certificate row → the **Status** column.

   <CustomTable>
     <table>
       <tbody>
         <tr>
           <th>ACTIVE</th><td>The certificate is valid and ready for use</td>
         </tr>

         <tr>
           <th>CREATING</th><td>The certificate is being issued</td>
         </tr>

         <tr>
           <th>RENEWING</th><td>30 days remain until certificate expiration, automatic renewal is in progress</td>
         </tr>

         <tr>
           <th>INVALID</th>

           <td>
             The certificate is invalid for one of the following reasons:

             <ul>
               <li>invalid signature;</li><li>broken certificate chain of trust (the root certificate could not be verified or the intermediate certificate has expired);</li><li>the certificate signature cannot be verified;</li><li>DNS-01 validation failed</li>
             </ul>
           </td>
         </tr>

         <tr>
           <th>ERROR</th><td>An error occurred during certificate issuance. Ensure your domain registrar has NS records configured that point to Selectel servers: `a.ns.selectel.ru`, `b.ns.selectel.ru`, `c.ns.selectel.ru`, `d.ns.selectel.ru`. If the problem persists, [create a ticket](https://my.selectel.ru/tickets/create/)</td>
         </tr>
       </tbody>
     </table>
   </CustomTable>

<Formbricks />