# Manage SSL certificates

See which certificate each domain uses, turn on HTTPS for a site, and know which certificates renew by themselves and which you have to replace.

## Before you start

- A domain connected to a site and pointing at its server. See [Add a domain to a site](https://app.nuvlo.dev/docs/add-a-domain).
- For a Cloudflare Origin certificate: Cloudflare connected and the domain proxied through Cloudflare. See [Connect Cloudflare](https://app.nuvlo.dev/docs/connect-cloudflare).

## Certificate types

Most domains need no action: Nuvlo issues a Let’s Encrypt certificate as soon as the domain points at your server. Choose another type only when you need it.

| Type | Use it when | Renewal |
| --- | --- | --- |
| Let’s Encrypt | The domain points straight at your server. Free. Port 80 must be reachable so Let’s Encrypt can check the domain. | Automatic, on the server |
| Cloudflare Origin | The domain is proxied through Cloudflare. Valid for 15 years, but only Cloudflare trusts it, so keep the proxy on. | Manual: replace it before it expires |
| Custom | You already have a certificate, for example from your company. You paste the certificate and its private key. | Manual: replace it before it expires |

## Step 1: Check your certificates

Open [Domains](https://app.nuvlo.dev/dashboard/domains). The **HTTPS** column shows each domain's certificate:

- **Let’s Encrypt**, **Cloudflare** or **Custom certificate** while the certificate is valid. Hover it for the expiry date and how it renews.
- **Expires <date>** when a Cloudflare or custom certificate has less than 30 days left, or a Let’s Encrypt certificate less than 14 (it normally renews at 30, so this means renewal is failing).
- **Expired <date>** once it has run out. Visitors see a security warning until you replace it.
- **Pending** while a certificate is being set up, and **Set up HTTPS** when there is none.

Clicking the HTTPS status opens the site's domain settings, where the certificate is managed.

![The Domains page with the HTTPS column showing each domain's certificate](https://app.nuvlo.dev/docs/shots/ssl-certificates--list.webp)

## Step 2: Open the site's HTTPS settings

- **WordPress site:** open the site and go to the **Domains** tab. The **HTTPS** card shows the **Status**, the **Certificate** and when it expires or renews.
- **Application, PHP or static site:** open the site, go to **Settings** and then **Domains**. Open the menu next to the domain and choose **Certificate**.

![An application's Settings, Domains view with the domain menu open, showing Certificate, Change domain and www redirect](https://app.nuvlo.dev/docs/shots/ssl-certificates--app-domain-menu.webp)

![The HTTPS card in a WordPress site's Domains tab](https://app.nuvlo.dev/docs/shots/ssl-certificates--https-card.webp)

## Step 3: Choose the certificate type

On a WordPress site, click **Turn on HTTPS**, or **Replace certificate** if one is already installed. Under **Certificate for** your domain, choose one of:

- **Let's Encrypt (free, auto-issued)**: the domain's A record must already point to the server IP shown below the field.
- **Cloudflare Origin (15-year, requires Cloudflare)**
- **Custom certificate (paste your own)**: paste the full chain into **Certificate (PEM, full chain)** and the key into **Private key (PEM)**.

On an application, PHP or static site, the **Certificate** dialog offers the same three types as **Let's Encrypt**, **Cloudflare Origin CA** and **Your own certificate**.

![The Certificate dialog of an application's domain with the three certificate types](https://app.nuvlo.dev/docs/shots/ssl-certificates--app-certificate.webp)

![The Turn on HTTPS dialog with the certificate type list](https://app.nuvlo.dev/docs/shots/ssl-certificates--turn-on.webp)

## Step 4: Install the certificate

Click **Install certificate** (or **Replace certificate** in an application's dialog). When it's done, the HTTPS status of a WordPress site changes to **On**, and an application's domain shows **Valid**.

For a Cloudflare Origin certificate, a second message lists the Cloudflare settings Nuvlo changed, or explains why it left them alone. See [Connect Cloudflare](https://app.nuvlo.dev/docs/connect-cloudflare).

## When a Cloudflare setting holds HTTPS up

If Cloudflare's SSL/TLS mode for the domain is **Flexible** or **Off**, Cloudflare talks to your server over plain HTTP and HTTPS on the server would loop. The HTTPS status then shows **Waiting for a Cloudflare setting**.

Click **Open Cloudflare SSL/TLS settings** and set the mode to **Full (strict)**. Nuvlo finishes HTTPS by itself once the setting is changed.

## Renewal

Let’s Encrypt certificates are renewed on the server before they expire. For that to keep working, the domain must keep pointing at the server and port 80 must stay reachable.

Nuvlo doesn't renew Cloudflare Origin or custom certificates. Install a new one from the same dialog before the expiry date.

On an application, PHP or static site, **Remove certificate** in the **Certificate** dialog stops HTTPS right away. A domain behind Cloudflare's proxy then shows a Cloudflare error until you install a certificate again.

---
Source: https://app.nuvlo.dev/docs/ssl-certificates