Overview
Certificates: the fleet list across every client sorted by soonest expiry, and per domain the current status, custom-certificate upload, PEM inspection before installing, and forced issuance. Private keys are never returned by anything in this document, and issuance and renewal are automatic — issue is only the escape hatch for a delegation the customer has just fixed.