SSL/TLS certificates

To facilitate URL redirects over HTTPS, you must create an SSL/TLS certificate for the relevant source domain to ensure a secure connection that prevents unauthorized third parties from intercepting data in transit.

The HTTPS protocol secures the data transfer through SSL or TLS encryption. SSL/TLS certificates employed by a web server or domain name contain public encryption keys that secure the connection to prevent unauthorized third parties from intercepting data while it is in transit and to validate the website's authenticity. Refer to HTTP vs. HTTPS for details.

When creating a redirect, you have the option to enable HTTPS. If enabled, you are presented with a second option to enforce HTTPS. Upon enabling HTTPS, the NS1 Connect platform automatically generates an SSL/TLS certificate corresponding to the domain of the source URL.

The number of URL redirects over HTTPS available depends on the type of plan that you have. You can view your plan type and usage limits on the Usage page.

The NS1 Connect platform leverages the Let’s Encrypt service, a certificate authority (CA), to generate SSL/TLS certificates, using the DNS01 challenge as validation. When a new certificate is generated (automatically or manually), the platform creates a TXT record for the corresponding domain with information about the SSL/TLS certificate.

Attention: Do not create a URL redirect over HTTPS if the domain name in the source URL is part of a dual primary configuration with another DNS provider. The certificate authority will not issue the certificate to NS1 Connect because it will be unable to validate ownership of the domain name.

Certificates and nameserver delegation

You can only create certificates for a domain in which NS1 Connect nameservers are the delegated authority. In other words, a primary zone must exist on your NS1 Connect account corresponding to the FQDN and the nameserver delegation is updated to point to NS1 Connect nameservers at the domain registrar. Refer to Delegating a domain to NS1 Connect for details.

Certificate rate limit

There are two limits placed on the rate of certificates generated within your NS1 Connect account:

  • Let’s Encrypt service limit: You can only generate up to 50 certificates for an individual domain per week. If certificate generation fails for this reason, you must delete the ticket and try again.
  • NS1 Connect limit: You can only generate 10 certificates for any domain per hour. If certificate generation fails for this reason, the NS1 Connect platform will add the certificate to a queue and complete the operation as soon as possible.

We recommend using wildcards in the source URL and certificates to facilitate communication over HTTPS for multiple subdomains, if applicable. This helps circumvent the rate limit mentioned above. For example, you can create a source URL and wildcard certificate for the domain *.example.com to cover all subdomains under example.com.

The following table demonstrates the certificate domain you would use to accommodate each source URL or group of source URLs in the left column. The middle column demonstrates the domain you would use if creating a single-domain certificate, whereas the right-most column demonstrates the domain you would use if creating a wildcard certificate.

Table 1. Certificate domains
Source URL(s) Domain(s) to use for single-domain certificate Domain to use for wildcard certificate
example.com/* example.com n/a
abc.example.com/about abc.example.com *.example.com
*.example.com n/a *.example.com
a.example.com/abc a.example.com *.example.comNote: A certificate for *.example.com does not apply to the root domain, example.com.
b.example.com/* b.example.com
c.example.com/bar c.example.com

A certificate must exist for each domain, subdomain, and wildcard domain specified in a URL redirect configuration if HTTPS is enabled.

Single-domain vs. Wildcard certificates

There are two types of certificates you can create in NS1 Connect: single-domain or wildcard.

  • A single-domain certificate can be used to cover one, static domain, such as example.com or sub.example.com.
  • A wildcard certificate covers multiple subdomains based on the placement of the asterisk. For example, you can create a wildcard certificate, *.example.com, to cover all first-level subdomains under example.com.

Redirects from multiple subdomains

If you plan to configure redirects from multiple subdomains, we recommend you create a wildcard certificate before the redirect configuration to prevent a high volume of certificates from being generated at once.

Creating a certificate

If the redirect configuration enables HTTPS, an SSL/TLS certificate is required for the corresponding domain. Typically, NS1 Connect automatically generates a certificate based on the source URL(s) defined in the redirect configuration upon saving a new redirect if a corresponding certificate doesn’t already exist.

Complete the following the steps to create an SSL/TLS certificate:

  1. Click Redirects.
  2. Click the SSL/TLS certificates tab.
  3. Click Create.
  4. Select the type of certificate you are creating: single-domain certificate or wildcard certificate.
  5. Select the zone FQDN corresponding to this certificate.
  6. If applicable, select the record domain corresponding to this certificate. This may be the same as the zone (apex), or it can be a subdomain within the zone FQDN.
  7. Click Create.

Upon creating the certificate, its status is displayed on the SSL/TLS certificates page. Initially, the certificate status shows In progress until certificate generation is complete.

Certificate statuses

You can view the status of an SSL/TLS certificate on the SSL/TLS certificates page (within Redirects).

  • In progress – The SSL/TLS certificate is being generated. Check back soon.
  • Ready - The SSL/TLS certificate was generated successfully and is active.
  • Error – Something went wrong. Hover over the error to view details, if available. Common errors include:
    • The rate limit was exceeded. You can only generate up to 50 certificates for an individual domain per week and only 10 certificates for any domain per hour. If certificate generation fails because you attempted to create more than 10 in one hour, NS1 Connect adds the certificate to a queue and completes the operation as soon as possible.
    • There was an issue due to a system timeout. Try refreshing the page. You may need to delete the certificate and recreate it.
    • The domain associated with the certificate could not be found in NS1 Connect; therefore, the platform could not create the TXT file within the corresponding zone. Ensure the DNS zone corresponding to this domain is created in your account before attempting to create a certificate.

NS1 Connect automatically renews expired SSL/TLS certificates.

Alerts for URL redirects certificates

To make sure that you stay informed about the status of certificates, you can create alerts to notify you if NS1 Connect encounters any issues with the automatic renewal of SSL/TLS certificates.

Revoking (deleting) SSL/TLS certificates

If you delete an HTTPS-enabled redirect configuration, you must manually delete or “revoke” an SSL/TLS certificate associated with a domain or subdomain.
  1. Click Redirects.
  2. Click the SSL/TLS certificates tab.
  3. Select the checkbox next to one or more certificates that you want to delete.
  4. Click Delete.
Note:

The CNAME is linked to the redirect certificate. The certificate is renewed when it expires. The system recreates the related ACME challenge CNAME each time this happens so the CNAME will return if the certificate is not deleted. To remove the CNAME record for good, you need to delete the redirect certificate.

Attention: Deleting an SSL/TLS certificate might cause your redirects to fail if HTTPS is enforced.