Certificates
Issued, renewed and never your problem
Every service and every domain gets a certificate automatically, at no charge, renewed thirty days early. The paid range exists for three specific cases, and this page says which three rather than selling you one.
$ keel domains attach api.example.dev --service api dns verified (2s) acme order placed tls issued (12s) expires in 90d renewal scheduled in 60d # nothing else to do. ever.
The range
| Certificate | Validates | Issued in | Names | Per year |
|---|---|---|---|---|
| Automatic, domain validated | Control of the name | Seconds | One per domain attached | 0.00 |
| Automatic wildcard | Control of the name | Seconds | All at one level | 0.00 |
| Organisation validated | The organisation exists | 1 to 3 days | Up to 100 | 96.00 |
| Extended validation | The organisation, in depth | 3 to 10 days | Up to 100 | 248.00 |
What it does, and what it does not
does
- Encrypts the connection, so what is sent cannot be read in transit.
- Proves the connection reached the name in the address bar.
- Lets the browser use HTTP/2 and HTTP/3, which it will not do without one.
- For an organisation-validated certificate, says who holds the name.
does not
- It does not make the application behind it secure. It is about the pipe, not what is in it.
- It does not stop a visitor being phished. An attacker can get one for their own name in seconds.
- It does not improve search ranking in any way worth paying for.
- A more expensive certificate does not encrypt more strongly. The cipher is the same.
Questions
Then why would I pay for one?
Three reasons. A contract or an auditor requires organisation validation; you need one certificate covering many unrelated names with a warranty; or a client of yours insists and you are not going to win that argument.
Is the free certificate less secure?
No. The encryption is identical. What differs is what was checked before issuance, and for a browser that is control of the name.
Can I bring my own certificate and key?
Yes, on any service, through the API. The key is stored encrypted and is not readable back out.
What about certificates for internal services?
Private services get an internal certificate automatically and are not reachable publicly, so there is nothing to issue and nothing to pay for.
Get started
You almost certainly do not need to pay for this
Not sure which of these you are? Describe what you are running and we will tell you.