Bridge certs

Bridge certs

To get a customer serving HTTPS through the WAF immediately, we issue a Sectigo cert via SSLStore and install it on Sucuri. This is the bridge cert.

Once onboarding is complete, Sucuri issues a long-term cert of its own for the domain and replaces the bridge. The bridge cert is no longer needed and should not need to renew.

Invariant

A customer still on a bridge cert weeks after onboarding completed is stalled — something prevented Sucuri’s cert pipeline from taking over. Investigate before letting the bridge cert renew.