SSL Overview

SSL (you’ll also see it called HTTPS, or just “the lock icon”) keeps the connection between your visitor and your website private. It also tells visitors your site is trustworthy — browsers now warn people away from sites without it.

With Managed DNS, SSL on nsin is free and automatic. There’s nothing to buy and nothing to install.

How nsin handles SSL

Once your domain is active with Managed DNS, nsin:

1. Issues a certificate covering your domain and its proxied hostnames.
2. Renews it automatically before it expires — you never have to remember.
3. Serves your site over https://.

Certificate status

The SSL section of your domain shows the certificate nsin is currently serving: who issued it, when it was issued, when it expires and how many days that leaves, and every hostname it covers.

Coverage gaps

If you add a new proxied hostname — say shop.example.com — it needs to be on the certificate before browsers will trust it. nsin picks this up and extends the certificate automatically, and until it has, the SSL page lists the hostname as a coverage gap so you know why it’s showing a warning.

A gap that doesn’t clear usually means the hostname isn’t reachable yet. Check that its DNS record exists and is proxied.

Issuing manually

If something went wrong, you can trigger a fresh issuance yourself. The button is rate-limited — certificate authorities limit how often they’ll issue for a domain, so nsin shows you when the next attempt is allowed rather than letting you burn through the quota.

Bringing your own certificate

You can upload a certificate you bought or issued elsewhere. This is required with External DNS, where nsin can’t issue for you, and optional with Managed DNS.

1. Go to the domain’s SSL section → Upload certificate.
2. Paste the certificate and its private key, both PEM-encoded.
3. nsin shows you what the certificate contains — subject, issuer, expiry and the hostnames it covers — before anything is installed.
4. Pick which of those hostnames this certificate should serve, and confirm.

Caution

Include the full chain. Paste your certificate and the intermediate certificate(s) your issuer gave you, not just the first block. A leaf-only upload looks fine in a browser that already happens to have the intermediate cached, and fails for everyone else — including curl and most mobile apps.

A custom certificate does not renew itself. Note its expiry date and upload a new one before then.

Wildcard certificates

A wildcard (*.example.com) covers every subdomain at one level. Certificate authorities only issue wildcards after a DNS-based check, so if you’re issuing your own, use the acme.sh DNS plugin — it creates and removes the required records through your API key automatically.

Make everyone use the secure version

Visitors who type http:// should end up on https://. Add a redirect from http to https — nsin’s recommendations will remind you if you haven’t.

Common questions

Do I need to buy a certificate? No — not with Managed DNS. nsin issues and renews one for free.

My browser says “Not Secure”. Check that the site is Active, that the hostname you’re visiting is on the certificate (see coverage gaps above), and that the page isn’t loading images or scripts over plain http://.

Will my certificate expire? An nsin-issued one, no — it renews itself. An uploaded one, yes. That’s on you to replace.

I uploaded a certificate and some clients still complain. Almost always a missing intermediate. Re-upload with the full chain.