Summary

  • Fastly counts TLS domains activated at month-end even when the certificate has expired. The counted unit is the activated name, not the certificate file.
  • Supplying a certificate leaves the hosted name in that service and renewal work with the customer. A specific move from an older product can also leave an earlier contractual term running.

The reminder emails can stop before the counting does. For customer-managed certificates, Fastly starts interface warnings thirty days before expiry and sends periodic emails to superusers. Once the certificate expires, automatic notifications end. A name still activated at month-end can nevertheless remain in the quantity used for billing.

The self-managed certificate guide describes the warning schedule. The TLS service options describe the other clock: activated domains count at month-end whether their certificates are valid or expired. A credential reaches the end of its life. The service setting has received no instruction to retire.

That distinction belongs in the economics of running somebody else’s website. The customer buys a usable HTTPS entrance. The operator manages a certificate, a name’s activation and a payment obligation. Closing the task for one does not settle the other two.

One folder, several counted names

A certificate can contain an apex domain, a subdomain or a wildcard entry. Fastly treats each entry as an item and combines names on customer-managed certificates with those on certificates it manages. The criterion is the activated domain at month-end. It is a different unit from certificate files or visits.

Putting names in a common document can reduce some administrative work. It does not rewrite the product’s counting unit. Forecasting hostname costs from the number of files produces an excellent description of the filing cabinet. It can be a poor description of what the supplier is serving.

The current public rate card puts Bring Your Own Certificates alongside managed TLS from a non-profit certificate authority, with a published excess rate of $20 per domain per month. An actual bill requires the account’s entitlement, the month-end activation list and its contracted rate. Owning the file is not, by itself, an exemption for the hosted name.

There is a second cost on the customer’s side: work. Somebody must follow the expiry date, arrange the replacement and check that it applies to the names still needed. A supplier can be charging for hosted TLS while the customer continues to supply some of its operating labour. The purchase should be assessed across that division of work.

Expired, activated and working are three states

An expired certificate cannot supply a valid TLS identity. A hostname may have another valid certificate, so the expiry of one file does not establish that the entire service has stopped. Nor does a name’s presence in the billing quantity establish a healthy connection. The count answers an administrative question; the customer needs an operational result.

The end of the emails makes this especially easy to overlook. Attention has reached the end of its schedule while the activation can persist. A name that remains useful needs a valid credential. A name whose purpose has ended needs an authorised retirement. The date on the old document cannot choose between them.

Retirement is a production decision too. The guide says that when all certificates on a domain are deactivated, Fastly no longer serves TLS traffic for it. Deleting a self-managed certificate first requires TLS to be disabled for all the domains on that certificate. A shared file can carry several services that somebody is still obliged to deliver.

Saving money therefore starts with the names that no longer have a purpose and the dependencies that remain. Deleting by the age of the paperwork can exchange a visible charge for a much more visible service problem. A tidy certificate folder is no substitute for knowing which customer entrances it supports.

Buying the document and buying its operation

Fastly’s TLS prerequisites include appropriate management rights, the ability to change relevant DNS records and domains added to a configured service. The self-managed route also needs a valid certificate and matching key. Possession of the file is one part of that operating capability.

On the Fastly-managed route, the platform handles procurement and renewal through ACME. DNS or CAA conditions can block renewal. A background attempt does not prove that the credential remains valid or that the activation used in the monthly count has changed.

The commercial comparison is the work and permissions retained by each side. Delegating procurement and renewal removes particular tasks. Deciding whether a hosted name should continue or end still needs someone who understands the service sold and the consequence of withdrawing it. Bringing a certificate divides the operation; it does not perform the whole operation.

A replacement can cross a product boundary

The prerequisites describe a specific case involving the older Customer-Provided TLS Certificate Hosting Service. Updating a previously uploaded certificate can preserve that service without a billing change. Removing the old certificate and uploading a new one using Fastly TLS brings the new item into the current product’s bill; the old certificate continues to be billed under any applicable contracted term.

A technical team could describe both jobs as renewal. The spending owner needs to know which path is being taken. Creating the new resource does not, by itself, end a duration already agreed for the old product. Completion includes knowing which obligation remains and what has started counting elsewhere.

The distinction brings the wider bargain into focus. Certificate validity, hostname activation and the life of a payment commitment are separate records behind one customer promise. Needed names should answer with a valid identity. Retired names should end through a decision that understands their shared dependencies.

A certificate has a written expiry date. A hosted name needs somebody responsible through its final activation. When the reminder emails fall silent, that person should already have made the decision. Otherwise, the quietest part of the inventory can become the least noticed part of the cost base.