---
title: Certs
description: Requesting, renewing, and managing TLS certificates issued via ACME.
---

## Introduction

A cert is a TLS certificate issued through [ACME](/docs/glossary/) — by default via [Let's Encrypt](https://letsencrypt.org/), with [ZeroSSL](https://zerossl.com/) available as an alternative provider. Certs live at the project level, alongside your serverlets, proxies, and DNS zones.

You don't usually need to think about certs at all: every [HTTP proxy](/docs/proxy/#tls-certificates) gets one automatically the moment it's created, covering its source domain with no configuration required. The Certs page exists for the cases where you want visibility or control beyond that — checking a certificate's expiry and issuance state, covering a domain with extra alternative names, forcing a renewal, or requesting a certificate ahead of attaching it anywhere.

:::note
Certs is a project feature and may not be enabled for every workspace yet. If the Certs page isn't available in your dashboard, automatic proxy certificates are unaffected — this only concerns direct, standalone cert management.
:::

## Automatic certs for proxies

When you create an HTTP proxy, Futrou provisions a matching cert behind the scenes:

- If a [DNS zone](/docs/dns/) already exists in the project for the proxy domain's parent (for example a zone for `example.com` and a proxy on `api.example.com`), Futrou requests a **wildcard** certificate for `*.example.com` with the apex domain (`example.com`) as an additional name — one certificate then covers the apex and every subdomain in that project.
- Otherwise, Futrou requests a certificate for the proxy's exact domain only.
- If an existing cert in the project already covers the domain (an exact match, or a wildcard whose base domain matches), nothing new is created.
- Auto-provisioning is skipped for generated `*.futrou.cloud` addresses — Futrou's own wildcard covers those, and Nasua doesn't issue certs for them.

This is why you'll typically see certs appear in the project without having created them by hand. Deleting the proxy doesn't delete the cert automatically — manage it from the Certs page if you no longer need it.

## Requesting a certificate

- **Region** — where the certificate is issued and validated, or **Auto** to let Futrou choose.
- **Domain** — the primary domain the certificate covers. Use `*.example.com` to request a wildcard.
- **Alt Names (SANs)** — additional domains covered by the same certificate, comma-separated. Optional.
- **Provider** — `Let's Encrypt` (default) or `ZeroSSL`.
- **Key Type** — `ECDSA` (default) or `RSA`.

Domain, provider, and key type can't be changed after creation — request a new certificate instead if you need different coverage.

## Validation

Domain ownership is validated the same way as elsewhere on the platform: a wildcard domain is validated over DNS (a TXT record challenge), a non-wildcard domain over HTTP. If the project's DNS zone for the domain is already hosted on Futrou, DNS validation typically completes without any action on your part; otherwise you may need matching DNS records in place before issuance succeeds.

## Status and lifecycle

A certificate's page shows live data fetched from Nasua at the time you open it, alongside the record stored in Futrou Cloud:

| Field | Meaning |
| --- | --- |
| **State** | `issued`, `pending`, `failed`, or `revoked`. |
| **Issued** | When the current certificate was last issued. |
| **Expires** | When the current certificate expires. |
| **Checks** | How many validation/issuance checks Nasua has recorded for it. |
| **Error message** | The reason for the most recent failure, if the last issuance or renewal attempt didn't succeed. |

A certificate that's still `pending` shortly after creation is normal — issuance and validation happen asynchronously against the ACME provider and aren't instant.

:::warning
If a certificate is still provisioning, live status from Nasua may not be available yet when you open it — this isn't an error, just try again shortly after creation.
:::

## Renewing

Futrou renews certificates automatically before they expire. Use **Renew** on a certificate's page to force an immediate renewal instead of waiting — useful after fixing a validation problem, or if you want a fresh certificate right away rather than on the automatic schedule.

## Troubleshooting a failed issuance

If a certificate's state is `failed`, check the **Error message** on its page first — it comes directly from the ACME issuance attempt. Common causes:

- **DNS validation didn't complete.** For a wildcard or DNS-validated domain, the required TXT record wasn't found in time. Confirm the domain's DNS zone is on Futrou (or that the challenge record was published at your external DNS provider) and retry with **Renew**.
- **HTTP validation didn't complete.** For a non-wildcard domain, the ACME provider couldn't reach an HTTP validation endpoint on the domain — typically because the domain doesn't point at Futrou yet, or a proxy for it doesn't exist.
- **Rate limits at the ACME provider.** Let's Encrypt and ZeroSSL both cap how many certificates can be issued for the same domain in a period; retrying immediately after a rate-limit failure won't help, wait and retry later, or switch provider.

## Deleting

Deleting a certificate removes it from Futrou Cloud and revokes it in Nasua. This doesn't affect the proxy or DNS zone it was covering — if a proxy still needs a certificate, a new one will be provisioned for it as needed.

## Region

Like other services, a cert runs in a specific [region](/docs/glossary/#region), or you can leave it on **Auto**. A cert should generally sit in the same region as the proxy or DNS zone it's paired with.