> ## Documentation Index
> Fetch the complete documentation index at: https://developers.aptranet.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate lifecycle

> Monitor certificate expiry and issuance, inspect consuming distributions, and resolve common certificate issues.

## Read certificate status

| Status | Meaning and action |
| - | - |
| Active | Certificate metadata reports a current certificate; verify delivery on the hostname as well |
| Pending | Provisioning or issuance is in progress; inspect issuance details and the linked distribution |
| Expired | The validity period has ended; replace imported material or investigate managed issuance |

The inventory summary counts certificates expiring within 30 days. Open a certificate to inspect its validity dates, domains, fingerprint, public certificate when available, and consuming distributions.

## Managed issuance

Managed certificates can include issuance status, attempts, last error, start and finish times, and the next retry or retry-after time. Configure hostnames and managed TLS on the linked Cloud CDN distribution. Confirm that DNS points to its expected target and that the hostname is configured correctly before waiting for another attempt.

Managed renewal is automatic. Imported certificates require you to supply replacement material before expiry.

## Safe removal

The API rejects deletion of a managed certificate and rejects deletion of an imported certificate still used by a distribution. Detach or replace it on every consuming distribution, then delete the unused imported certificate from the inventory.

## Troubleshooting

* **Upload rejected:** check PEM encoding, matching key, chain order, validity, name, and project quota. If root CA validation is enabled, supply a complete chain to a trusted root.
* **Certificate not selectable:** verify that the distribution and certificate belong to the same project and that your permissions allow certificate listing.
* **HTTPS hostname mismatch:** compare the requested hostname with the certificate's covered domains and the distribution's configured hostnames.
* **Pending issuance:** inspect the issuance error and retry information, validate DNS, and avoid repeated configuration changes while provisioning is underway.

For escalation, include the project, certificate and distribution IDs, hostname, and UTC failure time. Do not send private keys.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.