SSL Automation
No open ports, no DNS keys, and a warning when the renewal stops
Automatic renewal usually fails an operations review on three points: it wants port 80 open inbound to the server, it wants a DNS API key sitting on the server, and it says nothing when it stops working.
The fourth objection is usually that nobody can work out what automation costs once the certificates have to be renewed twice as often. The price is here too.
Validation without opening anything inbound to the server
An ACME client that validates over HTTP needs port 80 open inbound to the server. A client that validates over DNS needs an API key for your DNS provider, and that key then sits on the server with write access to your zone. Internal servers and appliances rarely allow either.
The one CNAME you create per domain
_dnsauth.<domain> CNAME <hash>.autodns.fairssl.dk
You create it once per registered domain. FairSSL writes the CA validation record in our own zone, and you do not touch your DNS again at renewal.
One record per domain
Wildcards, SAN names and new subdomains on the same registered domain all use the same CNAME delegation.
No DNS keys on the server
The client never gets access to your DNS zone, so a compromised server cannot change your DNS records.
Outbound HTTPS, no inbound rule
The server has to reach fairssl.dk over HTTPS. No inbound firewall rule is needed, and the server needs no public address.
What is monitored once the client is running
An automation that stops without saying so is worse than a renewal in the calendar. We measure both the certificate and the client that is supposed to renew it.
Renewal window checked hourly
We ask the CA over ARI when the certificate should be renewed and check every hour. If the CA does not answer, we fall back to 21 and 7 days before expiry.
The client stops reporting in
If a client halves its check-in rate we raise a warning. A certificate can stay valid long after the client that was going to renew it stopped running.
Whether the install succeeded
The Windows client reports the result of the install back. A certificate that issued but was never bound to the site counts as a failure.
Email alerts per profile
Alerts are configured per profile, so operations and development can be notified at different addresses.
Monitoring API
Status is available as JSON, or read directly by PRTG and Prometheus, so the certificates appear in the monitoring system you already watch.
Certificates without automation
Certificates that do not run automatically get expiry mail 28 days and 7 days before expiry.
What the automation costs
The fee is charged per main certificate, per year, on top of the price of the certificate itself.
A shorter lifetime means more issuances per year. The number of issuances does not change the price: you pay for the certificate under management, not per renewal.
- Up to 25 servers using that certificate are included in the fee. Each of them gets its own reissued certificate.
- Reissues cost nothing extra.
- Changing the SAN names on the certificate costs nothing extra.
- Additional ACME clients using the same certificate cost nothing extra.
A second certificate is priced on its own: its own certificate price plus the fee for a year.
Worked example and price details →Access and roles
The account can be split so that whoever runs the ACME client on a server cannot also order certificates or see the invoices. Keys can be issued for a single use or for reuse.
Roles, keys and profiles →Find your platform
The wizard in the control panel writes the setup for the platform you pick, with the account key and the domains already filled in. You copy it with one button and run it on the server.
Windows
Simple-ACME in the FairSSL edition fetches the certificate, installs it in the certificate store and binds it to the site or service.
IIS 8+, IIS 6-7.5, Exchange, RDS, ADFS, WAP, SQL Server, PRTG, Dynamics NAV/BC, Tomcat
See the setup →Linux
Stock lego with FairSSL as the ACME server. The generated command writes the certificate and reloads the service afterwards.
nginx, Apache, HAProxy, Traefik, Caddy, Postfix, lego
See the setup →macOS
Lego, with the same setup as on Linux.
lego
Appliances
FortiGate 7.6.3 and F5 BIG-IP 21.1.0 and newer speak ACME themselves. Older versions and the other boxes fetch the certificate through an agent or an enrollment URL.
FortiGate, FortiMail, FortiWeb, NetScaler ADC, F5 BIG-IP, Kemp LoadMaster, Cisco ASA, Cisco FDM, Kubernetes cert-manager
See the setup →What is not covered
The wizard does not write a setup for pfSense, Synology, Palo Alto or Sophos. If you run one of them, ask us before you buy and we will look at what can be done.
From order to a certificate that renews itself
Step three is the one a generic ACME guide does not have: the setup is written for your platform.
- 1
Order the certificate in the control panel and turn automation on for it.
- 2
Create the CNAME delegation for the domain. Once per registered domain.
- 3
Pick your platform in the wizard. The portal writes the setup command with the account key and the domains filled in, and you copy it with one button.
- 4
Run the command on the server. The client fetches the certificate, installs it and renews it on its own from then on.
We package the Windows client ourselves and rebuild it daily. Linux and macOS use stock lego, which the generated command calls. Download the Windows client
Get started in the control panel →Support by email and phone is free before, during and after the installation. Remote installation is a paid add-on at a fixed price.
Which certificates can run automatically
The automation issues DV and OV certificates from the DigiCert family. Brands in the catalogue right now: RapidSSL, Thawte, GeoTrust, DigiCert.
Runs automatically
DV, domain validated
The domain is validated through the CNAME delegation. First issuance and every renewal run without a person.
Runs automatically
OV, organisation validated
The organisation is validated once. After that the certificates issue automatically the same way DV does, with the company details in the certificate.
Needs a person
EV, extended validation
DigiCert sends an approval link by email before an EV certificate issues. That step cannot run without a person, so we do not call EV automated.
The cheapest certificate you can put on automation costs €46 a year. The automation fee is on top of that.
See every certificate →GlobalSign Managed SSL, if you would rather have the profile set up for you
A pre-vetted profile at GlobalSign where the domains are validated in advance. There is neither domain validation nor an approval mail per issuance.
The profile cannot be selected in the control panel. We set it up once we have looked at your domains and your organisation.
Certificates on many servers and appliances
A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.
Alerts on expiry and failed installations in sslbrain(opens sslbrain.com in a new tab)