---
title: "SSL Certificates"
description: "Manage the SSL/TLS certificates you attach to load balancers and CDN zones: Let’s Encrypt issuance, auto-renew, uploads and statuses."
category: "Settings"
language: en
source: https://cubepath.com/docs/products/settings/ssl-certificates
updated: 2026-08-04
---

# SSL Certificates

The **SSL Certificates** library manages the certificates you attach to your [Load Balancers](/docs/products/deployment/lb-listeners) and [CDN zones](/docs/products/deployment/cdn-settings). Open the **SSL Certificates** page in [my.cubepath.com](https://my.cubepath.com).

## Add a certificate

Click **Create Certificate** and pick one of two tabs:

- **Let's Encrypt** — a managed certificate. Give it a **Name**, select one of your active DNS zones, and choose the **Domain Names** to cover: the root domain (a checkbox) plus any subdomains you add. A subdomain of `*` issues a wildcard. A preview lists every domain that will be included.
- **Uploaded** — bring your own. Provide a **Name**, paste the **Certificate** and the matching **Private Key**, and optionally the intermediate **Chain**.

> Note: Let's Encrypt certificates require an **active DNS zone** in your account, because ownership is validated through a DNS challenge. If your domain's DNS is hosted elsewhere, either move the zone to CubePath or upload a certificate you obtained yourself.

> Tip: Include the **chain** when uploading. A certificate that works in your browser but fails in `curl` or on mobile is almost always a missing intermediate — desktop browsers often fetch it themselves and hide the problem.

## Auto-renew

When issuing a Let's Encrypt certificate, the **Auto Renew** switch (on by default) keeps it renewed before expiry, so attached resources never serve an expired certificate.

> Warning: Uploaded certificates are **not** renewed for you. Note the expiry date and set your own reminder — an expired certificate on a load balancer takes the service down for every visitor, and the failure is total rather than gradual.

## What you see

Each certificate is listed with its **name**, a type badge (**Let's Encrypt** or **Uploaded**) and a status badge:

| Status | Meaning |
|--------|---------|
| **Valid** | Issued and in use |
| **Pending** | Requested, issuance in progress |
| **Expired** | Past its expiry date — attached resources will fail TLS |
| **Failed** | Issuance didn't complete |

The card also shows the covered domains and the expiry date, flagging certificates that expire soon.

> Note: Newly requested certificates start as **Pending**, and the page refreshes automatically until they become valid.

## Renew and delete

For a valid Let's Encrypt certificate you can trigger a manual **Renew** at any time. The delete action removes a certificate from the library after a confirmation.

> Warning: Deleting a certificate that a listener or CDN zone is using leaves that resource without one. Issue and attach the replacement first, then delete the old certificate.