What is a Custom Access URL?
What is required to begin with a Custom Access URL?
Who will create the certificate request (CSR)?
Is it required to complete the two setup steps in a particular order?
What type of certificates are needed?
Which Certificate Authorities can be used?
What server type should be chosen when purchasing the certificate?
Are short-lived certificates supported?
What key size and signature algorithm are required?
Can one use a wildcard certificate?
Which files shall be uploaded?
What can be done if the CA provided a .zip bundle?
What file formats are accepted?
What is the reason behind “None of the uploaded certificates matches the CSR” error?
What is the reason behind the certificate was not signed by the intermediate or chain incomplete message?
When can errors about SHA-1 appear?
What is the reason for a ‘certificate that has no revocation information’ message?
How long does it take for the certificate to show as Valid?
Can one edit or replace the certificate after uploading it?
How can one point their domain to Egnyte?
What should be checked if a “domain configuration is incorrect” message appears?
Are there any other DNS records needed?
How long does the domain configuration take to show Configured correctly?
How to know if the Custom Access URL is fully configured?
How to renew the certificate before it expires?
Is it required to generate a new CSR to renew?
Will renewing cause downtime?
Who receives expiry reminder emails, and can that be changed?
Why do the reminder email and the certificate's expiry date don't match?
Certificate lifetimes are getting shorter, how does that affect the customer?
Does Egnyte support automatic certificate renewal?
A customer already uses automated (ACME) renewal outside Egnyte. Can they integrate it with Egnyte?
What are the steps to follow if the certificate is stuck in renewal state?
A customer uploaded a new certificate but the old one still shows, or the site shows Not Secure
How to change or remove the Custom Access URL?
What is a Custom Access URL?
A Custom Access URL lets users reach Egnyte at their own branded domain (for example, fileshare.yourcompany.com) instead of yourcompany.egnyte.com. It requires an SSL certificate and a DNS change.
What is required to begin with a Custom Access URL?
A domain that the admin controls, access to that domain's DNS settings, and an SSL certificate for the custom URL (this can be obtained from a Certificate Authority(CA) using the CSR Egnyte provides).
Who will create the certificate request (CSR)?
Egnyte generates the CSR on the Custom URL settings page. Use that CSR when requesting the certificate.
The private key stays securely on Egnyte's side, so a certificate made from any other CSR won't be accepted.
Is it required to complete the two setup steps in a particular order?
No. The two steps , that is, uploading the SSL certificate and configuring the domain (DNS) are completely independent and can be done in any order.
The Custom Access URL becomes active only once both steps reach their success state.
Choosing and Getting the Certificate
What type of certificates are needed?
A standard, publicly trusted SSL/TLS certificate for the custom domain. A basic domain-validated (DV) certificate is sufficient. One would not need Organization Validation (OV) or Extended Validation (EV) unless the organization requires it.
Which Certificate Authorities can be used?
One can use a certificate from any major public certificate authority. Egnyte works with standard, publicly trusted SSL/TLS certificates regardless of who issues them. Egnyte formally certifies and tests GoDaddy and DigiCert, so they're the smoothest, best-supported path; certificates from other trusted CAs work as well, though Egnytes does not formally certify each provider.
What server type should be chosen when purchasing the certificate?
Select Apache as the server type. This produces the certificate in a format Egnyte can install.
Are short-lived certificates supported?
Not currently. Certificates must include revocation information (a CRL or OCSP URL). Some very short-lived certificate profiles (for example, 6-day certificates) omit this information and will be rejected on upload. Use a standard certificate.
What key size and signature algorithm are required?
A 2048-bit or 4096-bit RSA key, signed with SHA-256. SHA-1 certificates are not accepted.
Can one use a wildcard certificate?
No. Wildcard certificates (for example, *.acme.com) are not supported for Custom Access URLs. Request a certificate for the specific custom hostname instead.
Uploading the Certificate
Which files shall be uploaded?
Upload all the files received from the certificate authority:
- Domain (leaf) certificate, and
- Every intermediate (CA/chain) certificate.
A missing intermediate certificate is the most common reason an upload fails.
What can be done if the CA provided a .zip bundle?
Unzip it first, then upload all the extracted certificate files. Don't upload the .zip itself.
What file formats are accepted?
The following extensions are allowed:
- .der
- .cer
- .pem
- .crt
What is the reason behind 'None of the uploaded certificates matches the CSR' error?
The certificate wasn't issued from the CSR Egnyte currently holds. This usually happens if the certificate was made from a different or older CSR.
Download the current CSR from the Custom URL settings page, request the certificate from that CSR, and upload it. Don't regenerate the CSR again before uploading as doing so invalidates any certificate already issued from the previous CSR.
What is the reason behind 'the certificate was not signed by the intermediate or chain incomplete' message?
An intermediate certificate is missing, or the wrong one was included. Upload the complete chain the CA provided. If the CA recently changed its chain, ensure that the current intermediate certificate is used.
When can errors about SHA-1 appear?
This error occurs when the certificate is signed with SHA-1, which isn't accepted. Ask the certificate authority to reissue it with SHA-256.
What is the reason for a ‘certificate that has no revocation information’ message?
The certificate has no CRL or OCSP information. Request a standard certificate from the CA that includes revocation data.
How long does it take for the certificate to show as Valid?
Verification of the uploaded certificates happens immediately, and errors if any are returned right away. After that, it can take up to 1 hour for the status to change to Valid which means the certificates have been installed for the domain.
Can one edit or replace the certificate after uploading it?
Yes, up until valid certificates have been uploaded and successfully validated. Once validation is complete, any further changes require assistance from the Egnyte Support team.
Configuring the Domain (DNS)
How can one point their domain to Egnyte?
Create a CNAME record for the custom URL pointing to the Egnyte address shown on the Custom URL settings page (typically access-<yourdomain>.egnyte.com).
What should be checked if a “domain configuration is incorrect” message appears?
Confirm the CNAME points to the exact Egnyte address shown in the settings, and allow time for the change to propagate.
Are there any other DNS records needed?
A CNAME record can't coexist with other record types on the same name. If one also needs email records (such as SPF/TXT) on that hostname, use an ALIAS record or set those records on a different name as per the DNS provider's guidance.
How long does the domain configuration take to show Configured correctly?
It can take up to 48 hours - the maximum amount of time most domain providers mention when one makes changes to their DNS records. In practice, however, it usually takes approximately 2–4 hours.
Confirming the Setup
How to know if the Custom Access URL is fully configured?
Custom Access URL is fully configured when both steps show their success status on the Custom URL settings page: the certificate shows Valid and the domain configuration shows Configured correctly. As a final check, open the custom URL in a browser and confirm it loads over HTTPS with a valid padlock and no certificate warning. After completing each step, the statuses may take some time to update.
Renewing the Certificate
How to renew the certificate before it expires?
Request a new certificate from the CA using the CSR on the Custom URL settings page, then upload the new certificate the same way as done initially. Custom Access URL keeps working throughout as the DNS record doesn't change.
Is it required to generate a new CSR to renew?
No, reuse the existing CSR. Only generate a new one if it is specifically needed to; if done, request the certificate from that new CSR and don't regenerate it again before uploading.
Will renewing cause downtime?
No. The custom URL and DNS record stay in place; only the certificate is replaced.
Who receives expiry reminder emails, and can that be changed?
Reminders go to the email address in the CSR and the domain's active administrators.
Why do the reminder email and the certificate's expiry date don't match?
If the certificate shows as valid in the browser and Custom Access URL works, the certificate is deployed correctly. If the dates still look inconsistent, contact Egnyte Support.
Certificate Lifetimes and Automatic Renewal
Certificate lifetimes are getting shorter, how does that affect the customer?
Across the industry, the maximum validity of public SSL/TLS certificates is being reduced in stages (down to about 47 days by 2029). Shorter lifetimes mean certificates need to be renewed more frequently, so it's worth setting up a repeatable renewal process and making sure the right people receive the expiry reminder emails.
Does Egnyte support automatic certificate renewal?
Not today, renewal is currently a manual process: when the certificate is nearing expiry, request a new one from the certificate authority using the CSR on the Custom URL settings page and upload it. The custom URL keeps working throughout. Automated renewal is on Egnyte’s future roadmap, though specific timelines cannot be shared yet. In the meantime, Egnyte recommends setting up a repeatable renewal process and making sure the right people receive the expiry reminder emails.
A customer already uses automated (ACME) renewal outside Egnyte. Can they integrate it with Egnyte?
Egnyte generates the certificate request (CSR) and securely holds the private key, so any external automation must work with that model. Specifically, the process must:
- Request the certificate using Egnyte's CSR and not a key or CSR generated by any other tool, or the certificate won't match
- Deliver the renewed certificate back to Egnyte. Currently, that final delivery step is a manual upload on the Custom URL settings page.
Troubleshooting
What are the steps to follow if the certificate is stuck in renewal state?
Verification is immediate, but it can take up to 1 hour for the status to change to Valid after a successful upload. If it hasn't cleared after that, contact Egnyte Support with the domain name.
A customer uploaded a new certificate but the old one still shows, or the site shows Not Secure
Deployment can take a little time to propagate. Try again after a short wait and clear the browser cache. If the old certificate persists, contact Egnyte Support.
How to change or remove the Custom Access URL?
Changing or removing a Custom Access URL is currently handled by the Egnyte Support team. Contact Egnyte Support and they'll make the required changes.