Ownership → routing → certificate → verification

From domain record to
reachable HTTPS website.

Manage a website’s account, local DNS zone, web-server configuration and certificates in connected workspaces. See which stage needs attention instead of treating a saved domain as a finished website.

Follow the domain lifecycle Explore DNS operations ↓

Follow a hostname through its distinct hosting, DNS and HTTPS stages.

SSL Center

Account ownership
Domain routing
DNS and certificate
Public verification

Four separate checkpoints

Provisioning is a sequence, not a switch.

Choose the owning account

Enter a valid domain and supported domain type. The administrator entry checks account ownership and the package’s domain allowance. Reserved service prefixes are created through the service-name workflow, not as ordinary root domains.

Prepare the hosted website

The lifecycle prepares the document root, creates a pending domain record, ensures DNS and generates Apache configuration. The selected account must have a supported installed PHP-FPM runtime.

Attempt eligible certificate work

AutoSSL is a separate step with package eligibility and hostname preflight. An issuance problem can be recorded as skipped or needing retry without making the entire domain provisioning run fail.

Verify the customer-facing result

Check public DNS authority, the intended website response, the certificate presented by the endpoint and any service URLs separately. A domain marked active does not establish that every HTTPS check passed.

Domain workspace

Know what each name points to.

Identity and owner: Domain name, owning account and domain type connect the public name to a hosting identity. Addon, subdomain and parked relationships are different choices—not interchangeable labels for the same routing behavior.
Execution context: Document root and PHP version identify where requests are served and which runtime handles them. A local path or generated service URL is configuration evidence, not proof that external visitors reach it.
Provisioning and SSL: Pending, active and failed domain states sit alongside SSL and HTTPS settings. Inspect both; the website lifecycle and certificate lifecycle can finish at different times.
Administrative actions: Add a domain, rebuild its virtual host or remove it using the supported ownership checks. Re-adding a same-owner pending or failed domain can resume provisioning. A domain already hosted elsewhere on the server is rejected.

For a hosting company, this separation makes handovers clearer: “the account owns the domain,” “the vhost exists” and “the public website is ready” are three different statements.

Authoritative DNS workspace

Edit the zone.
Verify the authority.

Record-level work

The editor supports A, AAAA, CNAME, MX, TXT, SPF, DKIM, DMARC, CAA, SRV and NS entries. Fields include name, value, TTL and priority where relevant. The current manager normalizes TTL to 300–86,400 seconds.

Add, edit, duplicate or delete records; apply bulk TTL changes; inspect the rendered zone; import or export supported zone text; and use mail-record helpers. The import parser handles a supported subset of zone lines—not every possible BIND zone-file construct.

Three evidence levels

A saved database record is first. Publishing the generated zone through the privileged BIND path is second. Public nameserver delegation reaching this server is third.

Record changes can persist before publication fails. Review the error and generated zone rather than assuming an atomic rollback. If DNS is hosted elsewhere, changing this local zone does not update that external provider.

Certificate lifecycle

Issue, inspect and retry with context.

Eligibility and work detection: AutoSSL checks the hosting package. Missing SSL state, expiry within 30 days, missing certificate files or expected-name mismatches can make a domain eligible for queued work. Hostname preflight can exclude failing optional names.
Queue evidence: Queued, running, completed and failed states retain attempt counts, last error and update time. The manual queue runner processes up to ten selected jobs per invocation. A queued record still needs execution; it is not a certificate.
Certificate workspace: Inspect issuer, subject, validity dates, fingerprint and subject alternative names. Supported actions include issue/reissue, verification, certificate downloads, force HTTPS and removal. Private-key downloads require an additional authentication step.
Renewal and availability: Expiring-certificate discovery and issuance code exist, but a deployed worker or schedule must actually run. Check the issuance outcome and public endpoint after certificate work.

What verification really means

Ask four different questions.

Does DNS point here?

Confirm the authoritative provider and public records. A local BIND zone, an A record and registrar delegation are related but separate pieces.

Does the website respond?

Check the expected host and application, not just any successful status. The current lifecycle check accepts HTTP 200, 301, 302 or 403 responses.

Is TLS trusted by the client?

The lifecycle HTTP probe uses certificate verification disabled. It checks reachability alongside certificate-file, name and vhost checks, but does not prove the full client trust chain.

And does the relevant service use that certificate?

Mail TLS synchronization is conditional on the certificate covering the mail hostname. Its synchronization warnings do not necessarily turn issuance into a failed queue item. Verify the actual SMTP/IMAP endpoint independently; an issued web certificate is not proof of successful mail TLS rollout.

See the account side of domain operations.

These customer workspaces show owned domain and DNS controls. Server-wide nameserver administration remains with the provider.

Customer domain controls, separate from administrator server configuration

Customer DNS record controls for owned domains

Change with customer impact in mind

Redirects and deletion are operational actions.

Enabling HTTPS redirection before usable TLS can make a working HTTP site harder to reach. Removing a certificate or domain affects generated service configuration and may affect customer data. Review ownership, backup needs and the actual outcome before repeating an action after an error.

Does active mean the domain has valid SSL?

No. The domain lifecycle can complete while AutoSSL or HTTPS verification needs another attempt. Inspect certificate state and the real endpoint separately.

Does editing DNS update my registrar?

No. This is local zone management. Registrar delegation and externally hosted DNS remain separate responsibilities.

Can I create mail or panel service names as ordinary domains?

The current lifecycle reserves admin, user, reseller, webmail and mail prefixes for generated service names. Add the underlying hosted domain through the supported workflow.

Is a successful internal verification enough?

It provides useful evidence, but not a complete external DNS, application, certificate-trust and mail-client test. Verify the service your customers actually use.