# Certificates

URL: /products/platform/certificates · Id: `capability:certificates`

> Certificates keep a valid TLS certificate on every serving Domain, renew it through delegated validation, and name the check that fails.

Certificates keep a valid TLS certificate on every serving [Domain](/business/nouns/domain), renew it through delegated validation, and name the check that fails. Public certificates last at most 200 days and shrink to 47 by 2029, so every renewal proves control again.

## Contract
| Clause | Terms |
| --- | --- |
| Starts | When a Domain verifies, [`Domain.connect`](/business/nouns/domain/connect) issues its certificate; the Domain reaches `live` only once the certificate is active. |
| Validation | `Domain.validation` is `delegated` for a name that points one CNAME at the platform, so each renewal passes with no step from the founder. |
| Apex | An apex whose DNS host refuses a CNAME points at the platform's fixed addresses, with `Domain.validation` set to `serving`. |
| Fixes | `Domain.certificate` names one failing check and its fix: a CAA record that excludes the platform's authority, a removed validation CNAME, or an apex that cannot hold a CNAME. |
| State | `Domain.certificate` holds `pending`, `active`, `renewing` or `failed`, the expiry, and the failing check with its fix. |
| Fails | A failed renewal moves a `live` Domain to `degraded` weeks before expiry, through [`Domain.verify`](/business/nouns/domain/verify). A degraded canonical Domain opens an [Incident](/business/nouns/incident). |
| Links | [Pages](/business/nouns/page) keep linking to a `degraded` Domain until its certificate expires, then render the link as plain text. |
| Paths | An [Interface](/business/nouns/interface) at a path, such as `/api`, shares the canonical Domain's certificate. An alias such as `api.` holds its own, read by `Domain.certificate`. |

## Verbs
| Verb | Object | Event |
| --- | --- | --- |
| [Domain.connect](/business/nouns/domain/connect) | [Domain](/business/nouns/domain) | [`Domain.connected`](/business/events/Domain.connected) |
| [Domain.verify](/business/nouns/domain/verify) | [Domain](/business/nouns/domain) | [`Domain.verified`](/business/events/Domain.verified) |

## Interfaces
- [API](/code/api/reference)
- [SDK](/code/sdk/reference)
- [CLI](/code/cli/reference)
- [MCP](/code/mcp/reference)

## Example
```json
{
  "$type": "Domain",
  "hostname": "fieldnotes.fm",
  "role": "canonical",
  "state": "degraded",
  "validation": "delegated",
  "certificate": {
    "state": "failed",
    "expiresAt": "2027-01-14T00:00:00Z",
    "failing": "A CAA record excludes the platform's certificate authority.",
    "fix": "Add the platform's certificate authority to the CAA record at your DNS host."
  }
}
```