Security at every step.

All accounts require an authenticator app. Recovery codes are single-use. Five failed password or authenticator attempts lock both the account and source IP for 24 hours.

Certificate records belong to your account. Public imports do not accept private keys. When you request certificate creation, the managed service generates a private key and holds it encrypted, separately from its certificate-authority account key.

Downloading a private-key package requires a fresh authenticator or unused recovery code and a package password. Packages are encrypted. Keep that password separately and restrict access to the downloaded key.

Creation requires approved certificate-provider setup and domain-control verification. A staging certificate is for testing; an issued certificate still needs installation and live verification. On a verified compatible server, a native client can renew and install replacements after one-time setup. Short validity reduces the misuse window after key compromise or incorrect issuance. Check task/timer failures and the certificate actually served; there is no guarantee for every server.

Keep your recovery codes somewhere secure. We never ask you to send passwords, authenticator secrets or private keys in chat.