redirect.pizza installs and renews SSL certificates for your hostnames automatically, so your redirects work over both http:// and https:// without you managing certificates. The SSL profile determines how long those certificates are valid and how often they're renewed.
Default profile
By default we use the tlsserver profile from Let's Encrypt. Certificates issued with this profile are valid for 45 days and are renewed well before they expire.
If Let's Encrypt is unavailable, rate limited or unable to issue a certificate, we fall back to ZeroSSL automatically. Certificates from ZeroSSL are valid for 90 days.
Short-lived certificates
Available from the Pro plan and up.
You can opt in to short-lived certificates, which use the shortlived profile from Let's Encrypt. These certificates are valid for 160 hours, just over 6 days, and are renewed far more often. Choose this if your security policy asks for short certificate lifetimes and you're comfortable relying fully on automatic renewal.
Modes
- Preferred: we try to issue a short-lived certificate first. If that fails, we fall back to a regular certificate. This is the default and recommended mode.
- Strict: we only issue short-lived certificates. If issuance fails, we don't fall back to a regular certificate, and the hostname may temporarily be without a valid certificate.
For most teams Preferred is the right choice: you get short-lived certificates when everything works and a regular certificate as a safety net when it doesn't. Use Strict only if short lifetimes are a hard requirement.
What changes
Your redirects keep working exactly the same way. The only differences are the validity period and the renewal frequency:
- Regular Let's Encrypt certificates (
tlsserver): valid for 45 days. - Short-lived certificates (
shortlived): valid for 160 hours.
You don't need to change DNS or renew anything by hand. redirect.pizza handles the whole process.
When a new profile takes effect
Changing the SSL profile doesn't replace the current certificate immediately. The new profile is used at the next renewal, so the active certificate stays in place until then.
Need help?
Not sure which profile fits your setup? Contact us via the chat or email support@redirect.pizza. We're happy to help.
