Skip to main content
Certificate issuance

Request Free SSL/TLS Certificates with CertOne

Use DNS authorization, CNAME validation, or HTTP validation in CertOne, then configure automatic renewal and deployment.

CertOne5 min read

CertOne manages the certificate lifecycle, from free Let's Encrypt issuance to automated renewal, deployment, and monitoring. Free certificates are trusted by major browsers; renewal and other services may use account credits. This guide covers DNS authorization, CNAME and HTTP validation, and automation settings.

1. CertOne overview​

1. Platform features​

Free certificate issuance:

  • Free issuance without a platform quota; CA rate limits apply
  • Issued by Let's Encrypt and trusted by major browsers
  • Single-domain, multi-domain, and wildcard support
  • 90-day certificates in this guide, with automatic renewal available

Automated management:

  • Renew before expiration
  • Deploy after renewal
  • Deploy to multiple nodes
  • Send expiration reminders

Validation methods:

  • DNS authorization
  • CNAME validation
  • HTTP validation

Deployment integrations:

  • Alibaba Cloud, Tencent Cloud, Huawei Cloud, and other providers
  • CDNs, load balancers, and certificate stores
  • Docker containers, BT Panel, and Synology NAS
  • Webhooks, SSH, and API-based workflows

2. Use cases​

  • Personal websites and blogs
  • Small and medium-sized business websites
  • Websites needing automated certificate management
  • Websites deploying to multiple nodes
  • Websites needing certificate monitoring

2. Register and sign in​

1. Create an account​

Visit CertOne, click Sign up, and provide:

  • Email address
  • Password
  • Verification code

Complete email verification using the code or instructions sent during registration.

2. Sign in​

Sign in to CertOne with your registered email address and password.

3. Create a DNS authorization​

Create a DNS authorization first if you choose DNS API validation.

1. Supported DNS providers​

CertOne supports DNS API credentials for providers including:

  • Alibaba Cloud DNS
  • Tencent Cloud DNS (DNSPod)
  • Cloudflare
  • AWS Route 53
  • GoDaddy
  • Huawei Cloud DNS
  • Baidu AI Cloud DNS

2. Create the authorization​

Step 1: Obtain provider API credentials

For Alibaba Cloud:

  1. Sign in to the Alibaba Cloud console
  2. Open AccessKey management
  3. Create an AccessKey and save its ID and secret
  4. Grant the required DNS management permissions

Step 2: Add the authorization in CertOne

  1. Sign in to CertOne
  2. Open DNS authorizations
  3. Click Add authorization
  4. Select the DNS provider
  5. Enter the API credentials
  6. Verify the credentials
  7. Save the authorization

3. Benefits of DNS authorization​

  • ✅ Automated validation without manual DNS changes
  • ✅ Automatic validation during renewal
  • ✅ Suitable for fully automated workflows

Request an SSL/TLS certificate​

1. Choose a validation method​

CertOne provides three methods:

DNS authorization:

  • Provide DNS provider API credentials
  • Enables automated validation

CNAME validation:

  • No DNS API credentials required
  • Add the specified CNAME records
  • Suitable when you prefer not to share DNS API credentials

HTTP validation:

  • No DNS record changes required
  • Configure the server to serve the HTTP challenge
  • Suitable when you can configure the web server

2. Issue with DNS authorization​

Step 1: Create a certificate

  1. Sign in to CertOne
  2. Open Certificates
  3. Click Create certificate
  4. Select DNS authorization

Step 2: Enter certificate details

  • Name: choose a recognizable certificate name
  • Domains: enter the names to include
    • Single domain: for example, www.example.com
    • Wildcard: for example, *.example.com
    • Multiple domains: add each required name
  • DNS authorization: select the credentials you created

Step 3: Submit

  1. Review the details
  2. Click Create certificate
  3. CertOne validates domain control and requests issuance
  4. The process usually completes within a few minutes

3. Issue with CNAME validation​

Step 1: Create a certificate

  1. Select CNAME validation
  2. Enter the certificate details

Step 2: Add the CNAME record

CertOne displays the required record, for example:

Type: CNAME
Name: _acme-challenge
Value: xxxxx.certone.io

Add this CNAME record with your DNS provider.

Step 3: Validate

  1. Wait for the new record to propagate, usually a few minutes
  2. CertOne checks the validation record
  3. Issuance proceeds after validation succeeds

Step 4: Keep the record for renewal

Keep the CNAME record in place so CertOne can validate future renewals automatically without DNS API credentials. Change it only if CertOne explicitly provides a replacement value.

4. Issue with HTTP validation​

Step 1: Create a certificate

  1. Select HTTP validation
  2. Enter the certificate details

Step 2: Configure the server

Follow the server or file instructions shown by CertOne. A challenge file example is:

Path: /.well-known/acme-challenge/xxxxx
Contents: yyyyy

Create the file under the web document root when using manual file validation.

Step 3: Configure HTTP access

Make sure the server serves /.well-known/acme-challenge/ over HTTP.

NGINX example:

location /.well-known/acme-challenge/ {
    root /var/www/html;
    try_files $uri =404;
}

Apache example:

Alias /.well-known/acme-challenge/ /var/www/html/.well-known/acme-challenge/
<Directory "/var/www/html/.well-known/acme-challenge/">
    Options None
    AllowOverride None
    Require all granted
</Directory>

Step 4: Validate

  1. CertOne checks the configured challenge endpoint
  2. Issuance proceeds after validation succeeds

5. Certificate settings and management​

1. Certificate details​

After issuance, the details page shows:

  • Domains, validity, and certificate type
  • Downloadable certificate files in PEM format
  • Downloadable private key
  • Downloadable full chain, including intermediates

2. Certificate configuration​

Click Configure to set:

Expiration reminders:

  • Email reminders before expiration
  • Configurable reminder lead time

Automatic renewal:

  • Renew before expiration
  • Configurable renewal lead time
  • Notifications after renewal

Automatic deployment:

  • Deploy renewed certificates to configured nodes
  • Select deployment targets
  • Deploy to multiple nodes

3. Version history​

Review each renewal in the certificate history:

  • Renewal time
  • Success or failure status
  • Details of the resulting certificate

4. Deployment history​

Review deployment records:

  • Deployment time
  • Target node
  • Success or failure status

6. Create deployment nodes​

1. Supported targets​

CertOne supports targets including:

Cloud providers:

  • Alibaba Cloud: certificate store, CDN, SLB, ALB, NLB, OSS, DCDN, FC
  • Tencent Cloud: certificate store, CDN, CLB
  • Huawei Cloud: CDN
  • Baidu AI Cloud: CDN
  • Qiniu: certificate store and CDN
  • DogeCloud: CDN

Servers and containers:

  • Docker: NGINX, Apache HTTPD, OpenResty, and custom containers
  • BT Panel: website and panel certificates
  • 1Panel: SSL certificates
  • Synology NAS: SSL certificates

Custom workflows:

  • Webhook
  • SSH scripts
  • API endpoints

2. Create a node​

Step 1: Prepare provider credentials

For cloud deployment:

  1. Create an API key in the provider console
  2. Enter the corresponding credentials in CertOne
  3. Verify that access works

Step 2: Create the deployment node

  1. Open Deployment nodes
  2. Click Create deployment node
  3. Select the target type
  4. Enter the node configuration
  5. Associate certificates
  6. Save the node

Step 3: Enable automatic deployment

Enable Auto-deployment in the certificate settings and select the nodes. CertOne deploys the certificate to them after renewal.

7. Certificate monitoring​

1. Create a site monitor​

CertOne can monitor the certificate served by a domain:

  1. Open Site monitors
  2. Click Create monitor
  3. Enter the monitoring details:
    • Domain
    • Port (443 by default)
    • IP address (optional)
  4. Configure notifications
  5. Save the monitor

2. Monitoring features​

  • Automatic certificate validity checks
  • Expiration reminders 20 days in advance
  • Email notifications
  • Monitoring for certificates issued outside CertOne

8. Common issues​

1. Issuance fails​

Possible causes:

  • DNS changes have not propagated
  • Incorrect DNS authorization configuration
  • Inaccessible HTTP challenge file
  • Domain validation timeout

Resolution:

  • Verify the DNS records
  • Check DNS API credentials and permissions
  • Check the HTTP challenge path
  • Wait for DNS propagation, then retry

2. Renewal fails​

Possible causes:

  • DNS credentials are no longer valid
  • Required DNS records are missing or incorrect
  • Inaccessible HTTP challenge file

Resolution:

  • Check DNS authorization status
  • Correct the DNS records
  • Check the HTTP validation endpoint

3. Automatic deployment fails​

Possible causes:

  • Incorrect deployment node configuration
  • Invalid API credentials
  • Network connectivity problems

Resolution:

  • Check the node configuration
  • Verify API access
  • Check network connectivity
  • Review deployment logs

Best practices​

1. Certificate management​

  • Give certificates meaningful names
  • Check certificate status regularly
  • Enable automatic renewal and deployment
  • Set expiration reminders

2. Security recommendations​

  • Store private keys securely
  • Rotate API keys regularly
  • Use strong passwords
  • Enable two-factor authentication where supported

3. Performance optimization​

  • Use wildcard certificates where suitable to reduce the inventory
  • Configure an appropriate renewal lead time
  • Integrate certificate deployment with your CDN

Conclusion​

CertOne provides certificate lifecycle management, including:

  • ✅ Free single-domain, multi-domain, and wildcard issuance
  • ✅ Automatic renewal
  • ✅ Automatic deployment to multiple nodes
  • ✅ Monitor certificate status
  • ✅ Flexible validation methods

CertOne helps individual website operators and IT teams manage HTTPS efficiently. Visit CertOne to start using the certificate service.