Settings › Overview, Certificates and ACME providers offer a guide
("Guided or manual?" each time) that:
- lists the domains with how their certificates are managed today, the
current certificate's expiry, and how each would be checked: through
DNS when the domain's DNS is connected (the domain and *.domain),
otherwise on port 443 (TLS-ALPN-01);
- before anything is ordered, looks up every name the order will ask
for (mta-sts, ua-auto-config, autoconfig, autodiscover, and the server
or MX name when it's in the domain) in public DNS and compares it with
where the server's own name points. Missing, Cloudflare-proxied and
elsewhere names each say what to fix; a domain with problems is left
out unless ordered anyway, or its DNS can be connected instead;
- reuses the Let's Encrypt account for that check method, or adds one
with the contact address; a staging switch gives a practice run;
- switches the chosen domains to automatic, removing an account it
added if that fails;
- watches the renewal tasks and certificates: issued with its expiry,
retrying with the reason, failed, or already covered by a valid
certificate with the date it renews.
jcoffey-dev