Certificates
Certificates keep a valid TLS certificate on every serving Domain, renew it through delegated validation, and name the check that fails.
Public certificates last at most 200 days and shrink to 47 by 2029, so every renewal proves control again.
Contract
| Clause | Terms |
|---|---|
| Starts | When a Domain verifies, Domain.connect issues its certificate; the Domain reaches live only once the certificate is active. |
| Validation | Domain.validation is delegated for a name that points one CNAME at the platform, so each renewal passes with no step from the founder. |
| Apex | An apex whose DNS host refuses a CNAME points at the platform's fixed addresses, with Domain.validation set to serving. |
| Fixes | Domain.certificate names one failing check and its fix: a CAA record that excludes the platform's authority, a removed validation CNAME, or an apex that cannot hold a CNAME. |
| State | Domain.certificate holds pending, active, renewing or failed, the expiry, and the failing check with its fix. |
| Fails | A failed renewal moves a live Domain to degraded weeks before expiry, through Domain.verify. A degraded canonical Domain opens an Incident. |
| Links | Pages keep linking to a degraded Domain until its certificate expires, then render the link as plain text. |
| Paths | An Interface at a path, such as /api, shares the canonical Domain's certificate. An alias such as api. holds its own, read by Domain.certificate. |
Verbs
Interfaces
Example
{
"$type": "Domain",
"hostname": "fieldnotes.fm",
"role": "canonical",
"state": "degraded",
"validation": "delegated",
"certificate": {
"state": "failed",
"expiresAt": "2027-01-14T00: