docs / Concepts
Certificate issuers
When you add a domain you choose who issues its certificate. The options differ in who signs them, whether browsers trust them, how they renew, and what they cost.
| Type | Browser-trusted | Best for | Cost |
|---|---|---|---|
| ACME (DV) LE / Google Trust | ✓ publicly trusted | Public sites, APIs, wildcards — checks only that you control the domain (DV) | Free |
| Private CA | Internal only | Internal systems, service-to-service, identities public CAs won't give | Free |
| Reseller OV/EV | ✓ publicly trusted | When you need organization validation — OV verifies the organization exists, EV verifies it more strictly | Paid |
| Imported | As per the cert | Certs issued elsewhere you want NOLAPSE to track | — |
A Private CA is not a public trust anchor — certs from it are trusted only by machines/browsers that have installed that CA, so they're for internal use only.