# Generate a Let's Encrypt Cert for Your Domain
import LetsEncryptExpiration from '~/includes/snippets/LetsEncryptExpiration/en/snippet.mdx'
import Apiv4Rollout from '~/includes/snippets/apiv4Rollout/en/snippet.mdx'
import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'
Web applications that use the HTTPS protocol require a [Certificate Manager](/en/documentation/products/build/applications/domains/mtls/). When you redirect your traffic to Azion, you have the option to generate a *Let's Encrypt*™ certificate, which is a free and secure way to encrypt data for your application. Azion automates the issuance, renewal, and deactivation of this TLS certificate through an internal certificate management solution.
---
## Before you begin
Azion generates Let's Encrypt certificates for domains and subdomains registered in the Domain Name System (DNS). Domains can be acquired and registered into DNS zones through a third-party DNS provider, such as [GoDaddy](http://www.godaddy.com/) or [Amazon AWS](https://aws.amazon.com/getting-started/hands-on/get-a-domain/).
For the purposes of this guide, assume that the fully-qualified domain name (FQDN) that you want to generate a Let's Encrypt certificate for is a CNAME record `www.yourdomain.org` under a `yourdomain.org` DNS zone.
:::note
Azion support for Let's Encrypt certificates is entirely subject to the availability and limitations defined by the Let's Encrypt service, as outlined in its [official documentation](https://letsencrypt.org/docs/rate-limits/).
:::
---
## Generating a Let's Encrypt certificate
You may choose to generate a Let's Encrypt certificate for domain records hosted in [Edge DNS](/en/documentation/products/secure/edge-dns/) or in the external DNS provider of your top-level domain.
To that end, you'll have to prepare your DNS server and register records for Azion to be able to create and manage your Let's Encrypt certificate.
:::note
There is also the possibility to [create a Let's Encrypt certificate via Azion CLI](/en/documentation/devtools/cli/create/#digital-certificate-id).
:::
### Option 1: Preparing DNS entry on Azion Edge DNS
Azion allows you to host DNS zones by redirecting the DNS resolution of a domain to **Edge DNS**. When using Edge DNS, all configurations needed are made through Azion interface.
To create a DNS zone for a domain entry `www.yourdomain.org` in **Edge DNS**:
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Edge DNS**.
2. If you don't have an active zone, click the **+ Zone** button.
3. Give your zone an easy-to-remember name.
4. Indicate the FQDN as recorded in the DNS. Example: `yourdomain.org`.
5. Click the **Save** button.
:::tip
For more information on how to redirect your domain's authoritative DNS servers, check the [Edge DNS](/en/documentation/products/secure/edge-dns/) documentation.
:::
Once your DNS resolution has been successfully redirected and is hosted in Edge DNS, you can create a new *CNAME record* for the domain by following the steps:
1. Still on the **Edge DNS** page, select the desired zone.
2. Navigate to the **Records** tab.
3. Click the **+ Record** button.
4. Under **Name**, create a hostname or subdomain.
5. Under **Record Type**, select **CNAME - Canonical name**.
6. Under **Value**, enter the Azion-provided domain address in FQDN format. Example: `xxxxxxxxxx.map.azionedge.net`
- If you don't have a domain, skip to section [Creating a domain](#creating-a-domain) for more information.
7. Set the **TTL** and **Policy** as desired.
8. Click the **Save** button.
If the **CNAME** entry listed in your Azion domain has been created in your **Edge DNS** zone, Azion will automatically verify the domain authenticity and the Let's Encrypt certificate will become active. Go to the section [Checking the status of Let's Encrypt certificates](#checking-the-status-of-lets-encrypt-certificates) for more information on certificate statuses.
### Option 2: Preparing DNS entry with an external DNS provider
If you have a domain registered in an external DNS zone, Azion will verify the domain authenticity in an external DNS provider by completing Let's Encrypt method called [DNS-01 ACME client challenge](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) to issue the certificate.
:::note
If you already have a zone in **Edge DNS**, the DNS-01 challenge will be completed automatically.
:::
To allow the DNS-01 challenge to occur:
1. Access your DNS provider's website.
2. Navigate to the DNS management area.
3. Create a **CNAME record** for each domain that you want to use with the certificate. Make sure this **CNAME record** matches the value you'll enter in the **CNAME** field when you create your Azion domain. For example:`www.yourdomain.org`.
4. Add a new record to your domain as follows:
| Name | Value | Type |
| --- | --- | --- |
| `_acme-challenge.`
For example:
`_acme-challenge.www.yourdomain.org` | `.letsencrypt.azion.com`
Example:
`www.yourdomain.org.letsencrypt.azion.com` | CNAME |
5. Repeat steps 3 and 4 for every CNAME you intend to add to your domain.
6. Save your settings.
Now that the challenge can take place, the next step is to bind your domain to an Application.
---
## Configuring your domain
Below are steps for adding a certificate to your application. There are separate instructions for the [legacy Domains](/en/documentation/products/build/applications/domains/) settings and the new [Workloads](/en/documentation/products/secure/workloads) product.
:::tip
If you're not sure which steps apply to your account, see [the Verify Your Account Migration to API v4 guide](/en/documentation/products/guides/verify-account-migration/) to determine if your account has already been migrated.
:::
Console - Workloads
Console - Domains
To create a **Workload**, you must have an application. If you haven't created an application yet, check the [Build an application documentation](/en/documentation/products/guides/build/build-an-application/).
Once you have an application, you need to [create a Workload](/en/documentation/products/secure/workloads) and list the CNAMEs that you want to secure with the Let's Encrypt certificate. To do so, follow these steps:
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Workloads**.
2. Click the **+ Workload** button.
3. Name your domain. Example: `Domain`.
4. Under the **Subdomain** and **Domain** fields, add the FQDN of the domain you created in the previous sections. Example: `www.yourdomain.org`.
5. Under **Applications**, select the application you created.
6. Under **Digital Certificate**, select the option **Let's Encrypt**.
7. Click the **Save** button.
:::note
The certificate will be issued using the **DNS-01** validation method. For domains hosted on Edge DNS, validation is automatic. For domains on external DNS providers, make sure the `_acme-challenge` CNAME record is correctly configured.
:::
To create an Azion **Domain**, you must have an application. If you haven't created an application yet, check the [build an application](/en/documentation/products/guides/build/build-an-application/) documentation.
Once you have an application, you need to [create a domain](/en/documentation/products/build/applications/domains/) and list the CNAMEs that you want to secure with the Let's Encrypt certificate. To do so, follow these steps:
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Domains**.
2. Click the **+ Domain** button.
3. Name your domain. Example: `Domain`.
4. Under **Applications**, select the application you created.
5. Under **CNAME**, add the FQDN of the domain you created in the previous sections. Example: `www.yourdomain.org`.
6. Under **Digital Certificate**, select the option **Let's Encrypt**.
7. Click the **Save** button.
:::note
The certificate will be issued using the **DNS-01** validation method. For domains hosted on Edge DNS, validation is automatic. For domains on external DNS providers, make sure the `_acme-challenge` CNAME record is correctly configured.
:::
---
## Checking the status of Let's Encrypt certificates
You can check the status of your Let's Encrypt TLS certificate by following these steps:
Console
API
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Certificate Manager**.
2. In your digital certificate list, you'll see a new entry in the format `Domain - Let's Encrypt `.
The status on the right of the list shows you whether the certificate has been issued. An **Active** certificate has been verified and issued successfully. A **Pending** status means the certificate is still undergoing checks in Azion's internal certificate manager.
You can use the following `GET` request: