> ## Documentation Index
> Fetch the complete documentation index at: https://docs.osto.one/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing SSL Certificates

> Upload and manage the certificates Osto uses to encrypt traffic between your origin and the internet.

Osto encrypts both legs of every request — between the user and Osto, and between Osto and your origin. There are two ways to control which certificate Osto presents:

1. **Auto-generate** — Osto provisions and renews a free SSL certificate for you (ACME-based, requires a one-time CNAME at your DNS provider).
2. **Bring your own** — you upload your own certificate bundle and Osto uses it.

This page describes managing the certificate pool you can pick from when you choose option 2. The auto-generate flow happens entirely inside the *Add Website* wizard — see [Managing Websites & Subdomains](/how-to-guides/asset-management/managing-websites).

> **Path:** Assets → Domains → Manage Certificate

## The certificate list

| Column         | What it shows                                                                  |
| -------------- | ------------------------------------------------------------------------------ |
| **Name**       | The name of the certificate (derived from the bundle or the domain it serves). |
| **Valid To**   | The certificate's expiry date.                                                 |
| **Status**     | Current state — e.g. *active*, *expired*.                                      |
| **Managed By** | Whether Osto auto-generated and manages this certificate, or you uploaded it.  |
| **Actions**    | **Delete** only — see *Editing* below.                                         |

## Adding an SSL Certificate

Certificates land in your pool from two places:

1. **Directly here**, via *Add Certificate +* on this page.
2. **Inside the Add Website wizard**, when you uncheck *Auto-generate certificate* and upload a ZIP — that upload is added to the pool for future reuse.

To add one from this page:

<Steps>
  <Step title="Navigate to Manage Certificate">
    Go to **Assets → Domains → Manage Certificate**.
  </Step>

  <Step title="Open the upload dialog">
    Click **Add Certificate +**.
  </Step>

  <Step title="Upload your certificate archive">
    In the *Upload Certificate Archive* dialog, drag-and-drop or click to upload a `.zip` file containing your certificate bundle.

    The ZIP must contain valid certificate files (`.crt` or `.pem`) and private key files (`.key` or `.pem`).
  </Step>

  <Step title="Confirm the certificate appears">
    The certificate appears in the list with its Name, Valid To, Status, and Managed By columns populated from the bundle contents.
  </Step>
</Steps>

<Note>
  The upload accepts only a single `.zip` file. If you have separate cert and key files, package them together into a ZIP before uploading.
</Note>

## Editing a certificate

There is no edit action on this page. To replace or update a certificate (for instance after renewal), **delete the existing one and upload the new one**. Domains that referenced the old certificate will pick up the new one automatically, as long as the new cert covers the same domain.

## Deleting a certificate

1. Click the **Delete** button on the certificate's row.
2. Confirm.

<Warning>
  A certificate can't be deleted while it's actively serving traffic for a registered domain. Switch the domain to *Auto-generate*, or upload a replacement first, before deleting an in-use cert.
</Warning>

## Tips

* **Wildcard certificates simplify operations.** One `*.example.com` upload covers every subdomain you register. Use them unless you have a compliance reason to issue per-host.
* **Don't have a certificate?** Use the *Auto-generate certificate* option in *Add Website* — Osto handles provisioning and renewal for you.
* **Track your own renewal cycle for uploaded certs.** Osto surfaces expiry in the **Valid To** and **Status** columns and in alerts, but renewal happens at your CA.

## Related

* [Managing Websites & Subdomains](/how-to-guides/asset-management/managing-websites) — the Add Website wizard step that uses these certs (and where the auto-generate flow lives).
* [What is Web Application Protection](/overview/what-is-web-app-protection) — how Osto's dual-layer TLS works in practice.