SSL certificates and domain management for Cascade sites

Most certificate problems announce themselves the same way: a browser warning on the homepage on a Monday morning, and a flurry of emails asking whether the site has been hacked. It has not. A certificate expired, or a renewal quietly failed weeks earlier. Certificates and domains are some of the least visible parts of a website and some of the most visible when they break. This article covers how they fit together for a Cascade site and how to keep them boring.

How domains and certificates fit together

Your domain name points visitors to the CDN in front of your site. The CDN presents a TLS certificate proving it is allowed to serve that name, then fetches content from the origin server where Cascade publishes. Three things must line up: the DNS record pointing to the right place, a valid certificate that covers the exact name visitors type, and a CDN configuration that knows to serve that name.

Choosing a certificate type

A wildcard covers news.example.edu but not example.edu itself and not events.news.example.edu. That catches people out, so certificates usually list the bare domain as well.

Why renewals fail

Automated certificates, such as those issued by AWS Certificate Manager, renew themselves, but only while the proof of domain control stays in place. The common failures:

• The validation record was deleted. DNS validation relies on a specific CNAME record. Someone cleaning up DNS sees an odd-looking record and removes it. Renewal fails silently until expiry.
• A CAA record blocks the issuer. CAA records list which certificate authorities may issue for your domain. If the list does not include the authority your hosting uses, issuance is refused.
• The domain moved DNS providers and the validation records did not come along.
• A manually purchased certificate was installed once, and nobody owned the calendar reminder for next year.

Checking a certificate yourself

Any browser shows the certificate when you click the padlock. From a terminal, this shows who issued it, what names it covers, and when it expires:

echo | openssl s_client -connect www.example.edu:443 -servername www.example.edu 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

And this shows whether a CAA record restricts issuance:

dig +short CAA example.edu

Adding a new domain: a checklist

1. Decide the canonical name (with or without www) and redirect the other one to it.
2. Add the name to the certificate, or confirm an existing wildcard covers it.
3. Complete domain validation and leave the validation record in place permanently.
4. Configure the CDN to accept the name, then point DNS at the CDN. The bare domain cannot be a CNAME at most DNS providers, so it needs an alias-style record.
5. Test https on both names, confirm http redirects to https, and check a few deep links, not only the homepage.
6. Check the published pages for hard-coded http:// links to images or scripts, which cause mixed-content warnings.

Who should own what

Domain problems often come from unclear ownership rather than technical faults. Write down, somewhere your team can find it, who owns each of these: the domain registrar account and its renewal, the DNS zone, the certificates, and the list of which names point where. The registrar renewal matters as much as the certificate. A domain that lapses takes email, the website, and every subdomain down together, and recovering it can take days. Turn on auto-renew at the registrar and make sure the renewal contact is a shared mailbox, not one person.

A note on HSTS

HTTP Strict Transport Security tells browsers to use https for your domain from then on. It is a good protection, and eWay enables it. Adding a domain to browsers' built-in preload list is a bigger commitment: it applies to every subdomain and is slow to undo. Confirm every subdomain serves https correctly before anyone requests preloading.

How eWay manages certificates and domains

For Cascade Website Hosting, eWay handles DNS architecture, domain configuration, and the full certificate lifecycle: provisioning, installation, renewal, and monitoring. Certificate expiry and DNS resolution are monitored continuously, so a renewal that is not progressing raises an alert well before any visitor sees a warning. HTTP is redirected to HTTPS, TLS 1.2 or later is enforced, and new domains are added through a change process that includes the validation record, so cleanup work later does not break renewals.

What to include in a support ticket

• The severity you would assign, P1 to P4 (see severity levels and response times)
• The exact domain names involved, including the bare domain if relevant
• The browser warning text or a screenshot
• Any recent DNS change, registrar change, or new subdomain

eWay customers can open a ticket in the support portal or email support@ewaycorp.com at any time. See how to request support for all the options. Related reading: securing a Cascade site and managing DNS and pointing your domain to your site. More at Cascade Website Hosting.