Lumen help

Creating a Let's Encrypt certificate

If you want to avoid the process of working directly with a certificate authority, you can create a Let's Encrypt certificate using Media portal. Let's Encrypt is an open-source certificate authority. If you're migrating from another provider to Lumen, learn how to request a certificate for migrating your properties.

Note: Before using Let's Encrypt certificates with live traffic, be sure that they are compatible with your needs. Learn more about Let's Encrypt certificate compatibility

Standard certificates

Certificate state	Description
active	The certificate is active and usable in Media portal.
stdPending	Standard certificates only. The certificate is being refreshed. The certificate may or may not be active during this load as well.

Let's Encrypt certificates

Certificate state	Description	Editable in this state?
active	The certificate is active and usable in Media portal.	Yes
leAcceptedCsrData	CSR data has been accepted as first step of creating/renewing the certificate.	No
leCnameCreationStarted	CName records are being created.	Yes
leCnameCreationComplete	CName records have been created.	Yes
leCreateRenewStarted	Let's Encrypt has started creating/renewing the certificate.	No
leCreateRenewWorkingChallenges	The Let's Encrypt agent is currently working through challenges while creating/renewing this certificate.	No
leCreateRenewAwaitingLeResponse	The Let's Encrypt agent waiting for the Let's Encrypt service while creating/renewing this certificate.	No
leCreateRenewFailed	Create/renew failed and there is no currently active certificate for this record.	Yes
leCleaningConfigs	Configurations are being cleaned	--
leRevokeInProgress	Certificate is in the process of being revoked.	--
leCnameCreationFailed	CName/FPDS records could not be created.	Yes
leRevokeComplete	The certificate was revoked successfully.	--
leRevokeFailed	The certificate could not be revoked.	--
leUnreferenced	The certificate isn't referenced by any SI in any production slot.	--

From the main menu, select My Services > Caching.

From the lists, select the access group and SCID (service component ID) you want to work with.

My Services - Caching (with SCID selected)

Click Manage Certificates.

Media portal lists the certificates associated with the SCID you selected. Certificates in active state are ready to use; certificates with other states may need your attention or may still being processed. Use the section below to learn more about certificate states, click the section below.

My Services - Caching (Manage Certificates)

To create a Let's Encrypt certificate:

From the main menu, select My Services > Caching.

From the lists, select the access group and SCID (service component ID) you want to work with.

Click Manage Certificates.

Media portal lists the certificates associated with the SCID you selected. Certificates in active state are ready to use; certificates with other states may need your attention or may still being processed. Use the section below to learn more about certificate states, click the section below.

Click New Certificate.

In the Certificate Name field, type the name for the new certificate.

Click Request Let's Encrypt.

My Services - Caching (Request Let's Encrypt)

Fill in the information for the certificate:
1. If you don't want the certificate to automatically renew, clear the Auto-Renew checkbox. (We recommend you let the certificate automatically renew so you don't have to remember to renew it on your own.)
2. In the Common Name field, type the fully qualified domain name you want to secure. (You can use a wildcard in the domain name to indicate all subdomains. For example, *.domain.com secures all subdomains under domain.com.)
3. From the Key Algorithm list, select RSA.
4. From the Key Parameter list, select the number of characters for the certificate: 2048 or 4096.
5. If you need to specify additional host names for the certificate, click Add (in the Subject Alternate Names (SAN) field), then type the fully qualified domain name. (Repeat this step to add additional host names. When you use this certificate on a property, you must list all host names you specify here in the Aliases list on the property.)
6. Click Submit.
  
  Very Important - Action is needed by you for the Let’s Encrypt provisioning process to succeed.
  
  Once your request has been submitted, our system automatically generates Let’s Encrypt specific CNAMES corresponding to your Common Name and optional Subject Alternate Names (SANs). You must add these CNAME records to your DNS system for us to pass the electronic Let’s Encrypt challenge that is required to prove that we are authorized to act on your behalf. Upon clicking submit, you have the option to be notified by email once they are created, but you can also simply click on the certificate name where you will find them listed once available
  
  Note: These CNAMES should not be confused with those needed to route traffic to our network. These are provided within the property details of your configuration, after you have promoted it. Wildcard CNAMES will be different than the Let’s Encrypt Challenge CNAMES.

Click Close.

You can now reference the certificate in a property on a configuration and before you promote it to production don’t forget to add the required Let’s Encrypt CNAMEs provided to your DNS system. This is important because your certificate request is processed only after you have promoted your configuration. You can track the various states of this process in Environment History. Once your configuration is successfully promoted, your certificate will have been obtained and activated.