Frequently asked questions

Let's Encrypt issues the domain-validated certificate without a certificate fee. Your RymarisCerts plan pays for management, expiry reminders, renewal guidance and protected downloads. Installation assistance is quoted separately before payment.

For a supported server, follow the automatic setup guide once: its native client renews and installs replacements on your server. Manual protected downloads remain a fallback. Downloading or paying alone does not configure a server. Hands-on setup is separately quoted; never send passwords or private keys in the request.

You need a confirmed account with mandatory two-factor authentication, control of the requested domain and access to the required DNS records. Installation also requires the appropriate server administrator or hosting-panel access. A certificate does not provide hosting, register a domain or change where DNS points.

Check your hosting provider's import requirements first. These guides cover modern Windows IIS, Apache 2.4 and Nginx; a managed platform may require different files or may manage HTTPS itself. Ask the provider before changing its configuration.

Choose encrypted PFX for modern Windows/IIS. Choose the PEM ZIP for Apache or Nginx; it contains certificate.pem, fullchain.pem and private-key.encrypted.pem. Other products may require conversion or a provider-specific import. Do not upload the private key to a public website.

Yes. On your dashboard, find the issued request and open Download again or change server format. Choose IIS PFX for modern Windows or PEM ZIP for Apache/Nginx, then provide a new package password and fresh two-factor verification. The saved certificate and matching key are repackaged; hostnames and expiry stay the same. Changing only the format does not require a new certificate order or DNS verification. Follow the new server's installation guide. Changing hostnames or the key algorithm requires a new certificate request.

RSA 2048, 3072 and 4096 bits and ECDSA P-256/P-384 are available. RSA-3072 is the default. Key size is measured in bits, not download size. Check your server and client compatibility before choosing; a larger number is not a substitute for correct installation.

*.example.com covers one level, such as www.example.com. It does not cover example.com or a.b.example.com. Select the base-domain option when requesting wildcard coverage if you also need example.com. Verify the actual names listed on the issued certificate.

Regular and wildcard certificates use the same plan price and one domain allowance, including the optional base-domain name. Wildcards require DNS verification.

The current Let's Encrypt workflow issues domain-validated TLS certificates. It does not provide OV/EV business identity validation, email-signing or code-signing certificates.

A full certificate package contains its private key. A fresh second factor authorizes export, and your package password encrypts the download. Use a unique password of 12–128 characters and keep it separate from the package. A public PEM download alone cannot install a complete server identity.

Check that you used a production certificate, installed its chain and matching private key, selected the right site binding, and covered the exact hostname. Check DNS and both IPv4/IPv6 destinations. Never bypass the warning as proof of success. See the server guide's troubleshooting checklist.

The HTTPS binding, SNI hostname, reverse proxy/CDN or DNS destination may still select another certificate or server. Verify the served SHA-256 fingerprint against the replacement. Preserve other sites' bindings and test every requested hostname from another device.

Use the password for that exact package. Do not mix files from different requests. Modern PFX protection may not import on older Windows versions. Check supported formats with your host; do not weaken encryption or disclose your password to troubleshoot.

Yes. Each additional package is a separate annual subscription. The domain allowances from all active,paid packages add together; for example,Starter plus Standard covers four domains. Each purchase has its own period and renewal. Regular and wildcard coverage use the same allowance. Payments remain disabled during early access.

Open Billing & help to see each purchased package,current period,management access end,expected renewal,annual amount and cancellation/payment status. A renewal requires verified provider confirmation. Scheduled cancellation preserves access until that package's paid period ends. Expired or unpaid packages stop contributing capacity;other active packages remain. Existing domains and saved certificates are retained. If your active domains exceed the remaining allowance,archive extras or add an active package before new management operations.

No. The management subscription and the certificate lifetime are separate. Use the actual expiry and renewal information on your dashboard. Each replacement still needs installation on your server.

After one-time setup on a verified compatible configuration, the native server client obtains and installs replacements automatically. Confirm its task/timer and monitor the certificate actually served. The portal manual-download workflow still requires installation. A payment, reminder, order or task launch alone does not prove renewal installation.

Cancellation does not uninstall certificates from your server. A period-end cancellation keeps paid management access until its recorded end date. Existing certificates still expire on their own dates; arrange renewal and installation independently. Use the billing portal to review your subscription.

Sign in and open Billing & help. Select your system and describe the problem without secrets. Review an individual quote before checkout. Paying a quote does not mean installation has already been performed.

Staging certificates are for testing and are not publicly trusted. Use a production certificate for a real public website. Our recordings use clearly labeled disposable lab certificates. Real deployments must pass normal public trust without installing a lab root or bypassing warnings.

We cannot tell you the password you chose. If your account and issued request remain available, use fresh MFA to export another protected package with a new password. If you suspect a private key was exposed, contact support to plan revocation and replacement; changing a download password does not revoke an exposed certificate.

Public certificate history stays while your account exists. Portal-managed encrypted private keys remain available while the certificate is valid and become eligible for removal 30 days after expiry. We send a transactional security notice at least seven days before removal, with a final protected-download opportunity. Failed or delayed notices delay removal. Every export still needs fresh MFA and your own package password. After removal, request a new certificate. Native client keys stay on your server; this policy does not remove them. Automatic removal is separately controlled during early access;see the status on your issued requests.

No. Removal clears the encrypted private key from the active database and retains public certificate/history records. Older encrypted database backups age out under the configured recovery-retention policy. It does not delete a copy you downloaded or a key held by your native server client, and it is not certificate revocation.

Yes. The IIS PowerShell and Apache/Nginx terminal videos record commands actually executed on isolated demo servers, including installation, renewal, rollback and HTTPS verification. They use disposable, untrusted lab certificates and omit passwords and MFA. Each silent recording has English captions, eight chapters and a transcript. Quick slide overviews remain available.

Short lifetimes limit how long a stolen private key or incorrectly issued certificate can be misused. Automatic replacement makes frequent renewal practical and reduces repeated manual key handling. It does not repair a compromised server or remove the need to revoke an exposed key. Annual management billing and certificate validity are separate.

The customer or server administrator performs a one-time native-client setup using the supported server guide, or can request separately quoted setup help. Some managed hosts already handle renewal. Verify domain validation, installation and the scheduled action before relying on it.

No universal guarantee is offered. The published lab configurations are Windows Server2025/IIS10 with simple-acme/WACS2.4.1 and Ubuntu24.04 Apache2.4/Nginx1.24 with Certbot2.9. Other versions, managed hosting, proxies, containers and DNS integrations require a compatibility review. Manual downloads remain available.

Wildcards require DNS validation. Unattended renewal needs a compatible DNS API integration or delegated validation with carefully restricted credentials. The verified HTTP-01 walkthroughs do not establish wildcard DNS automation. Use a separate compatibility review; manually entering TXT records each time is not automatic.

Enable ‘Track the certificate served over public HTTPS’ for the domain. Account activity refreshes eligible public checks at most every 15 minutes; scheduled checks run only when the operator enables daily processing. A trusted replacement updates the live observation while preserving saved history and portal-issued packages. Expiry notices use a recent verified observation for live-managed domains; other domains use the latest saved certificate. If HTTPS is unreachable or untrusted, the last good certificate stays in history and a separate review notice can be sent when email notifications and reminder services are enabled. This does not prove renewal failed. Checks observe one public port-443 endpoint at one time; verify additional servers, IPv6 and load-balancer destinations independently. Private keys remain on the native client's server.

The native client talks directly to the certificate authority and keeps its private keys on your server. RymarisCerts can check/save the public certificate but cannot export a private key it never received. Back up the native client securely. Certificates issued through the portal manual workflow support protected PFX/PEM repeat downloads with fresh MFA while their private key remains within the retention policy.

The supported setup includes checking native task/timer results, client logs and the certificate actually served. Investigate failures before expiry and retain a protected working configuration. Failure monitoring must be configured; RymarisCerts email reminders also require the reminder service to be enabled. During initial testing scheduled reminders remain disabled.