SSL Overview

SSL (also called HTTPS, or “the lock icon”) keeps the connection between visitor and website private. Without it, browsers warn people away. With Managed DNS, SSL on nsin is free and automatic — nothing to buy, nothing to install.

How nsin handles SSL

Once your domain is active on Managed DNS, nsin:

1. Issues a certificate covering it and its proxied hostnames.
2. Renews it automatically before it expires.
3. Serves your site over https://.

Certificate status

The SSL section shows the certificate’s issuer, issue date, expiry (days left), and every hostname it covers.

• Coverage gap — a new proxied hostname (say shop.example.com) must be on the certificate before browsers trust it. nsin adds it automatically; until then the page flags a gap. A gap that won’t clear usually means the hostname isn’t reachable — check its DNS record exists and is proxied.
• Manual issuance — trigger a fresh one yourself. It’s rate-limited (certificate authorities cap how often they’ll issue), so nsin shows when you can try again.

Automatic SSL with External DNS

With External DNS, SSL is automatic too — the CNAME record that verifies your domain also issues and renews a certificate covering example.com and *.example.com.

• Leave the record in place. Removing or changing it counts as moving away: nsin serves for a 3-day grace period (you’re notified), then disables it. Put it back to reactivate.
• Verified via the older TXT record? Keep uploading your own certificates until you add the CNAME.
• Provider blocks underscore-prefixed names? Upload your own certificate — always an option.
• A CAA record without letsencrypt.org blocks issuance; the SSL page flags it.

Bringing your own certificate

Optional in both modes; on External DNS it’s also the fallback until you add the verification record.

1. Go to the domain’s SSL section → Upload certificate.
2. Paste the certificate and private key, both PEM-encoded.
3. nsin shows the subject, issuer, expiry, and hostnames covered.
4. Pick which hostnames it should serve, and confirm.

Caution

Include the full chain. Paste your certificate and the intermediate certificate(s), not just the first block. A leaf-only upload can pass in a browser with the intermediate cached, and still fail in curl and most mobile apps.

A custom certificate does not renew itself. Upload a new one before it expires, or add the External DNS verification record and let nsin handle it.

Wildcard certificates

A wildcard (*.example.com) covers every subdomain at one level. Certificate authorities only issue one after a DNS-based check — if you’re issuing your own, the acme.sh DNS plugin creates and removes the required records through your API key.

Make everyone use the secure version

Already done: every proxied record answers plain HTTP on port 80 with a redirect to https://. Nothing to switch on, no way to turn off.

HSTS goes further: the browser refuses plain HTTP, so it never even requests it. Read that section first — it’s the one setting here that can’t be undone.

You can also raise the minimum TLS version from 1.2 to 1.3; nothing below 1.2 is ever accepted.

Common questions

Do I need to buy a certificate? No. Both modes get one automatically once the domain is verified.

My browser says “Not Secure”. Check the site is Active, the hostname is on the certificate (see coverage gaps above), and the page isn’t loading resources over plain HTTP.

Will my certificate expire? An nsin-issued one, no. An uploaded one, yes — that’s on you.

Some clients still complain about my uploaded certificate. Almost always a missing intermediate. Re-upload with the full chain.