Forge renews Let's Encrypt automatically.
Until a client changes DNS and renewal breaks silently.

Forge renewal fails after DNS changes

A client DNS change points the domain away from the Forge server, so Forge's HTTP-validated Let's Encrypt renewal fails silently

Forge's Let's Encrypt integration uses HTTP-01 or DNS-01 domain validation to renew certificates automatically before expiry. HTTP-01 validation requires the domain to resolve to the Forge-managed server so the Let's Encrypt challenge request can be answered. When a client transfers their domain to a new registrar, consolidates nameservers, or makes a DNS change that redirects the root domain or subdomain away from the Forge server IP address, the next renewal attempt fails. Forge logs the failure, but most agencies are not checking Forge server logs daily. The certificate continues serving traffic — with a decreasing validity period — until it expires and the Laravel application returns an SSL error to every visitor. By the time the expiry is discovered, there may be less than a week of validity remaining and the agency is troubleshooting a live outage rather than a scheduled renewal.

Vapor API subdomains: independent ACM certs

Each Vapor environment's API subdomain gets its own ACM certificate that renews independently from the primary domain

Laravel Vapor provisions AWS ACM certificates for custom domains configured on each Vapor environment. An application deployed with production, staging, and queue environments will have three separately provisioned ACM certificates — one per environment API subdomain. Each ACM certificate requires DNS validation: a CNAME record pointing at an ACM validation endpoint must be present in the client's DNS zone. If the client's DNS provider or registrar changes and the validation CNAME records are not migrated, ACM cannot renew the certificates for any Vapor environment. Because ACM certificates are managed per AWS account, the agency cannot access the ACM console without the client's AWS credentials or a delegated IAM role — the SSL expiry risk is invisible until the Vapor API endpoint starts rejecting SSL connections from the client application.

Subdomains multiply the SSL surface

Horizon, Nova, and API subdomains each run as a separate Forge site with its own independently renewed cert

A single Laravel client application often runs under three to five DNS records: the primary domain, a Horizon queue monitoring subdomain, a Nova admin subdomain, an API subdomain for mobile or SPA consumers, and a staging subdomain. In a Forge deployment, each subdomain is a separate Forge site on the same server — and each Forge site has its own Let's Encrypt certificate, renewed independently. If a client DNS change breaks renewal for the primary domain, it typically also breaks renewal for every subdomain on the same server, since they share the same server IP and the same DNS dependency. Five certificates expire instead of one. Agencies without automated SSL monitoring across every subdomain discover the full scope of the failure when clients begin reporting errors across multiple application surfaces simultaneously.

Reports under your brand

Hand each client a polished SSL, DNS, and security report carrying your agency’s name and logo — not ours.

Status pages on their domain

Publish a live status page at status.theirbrand.com with automatic TLS and no “Powered by Merlonix” badge.

Your margin to keep

You pay one add-on cost and package it into the retainer you already bill. The markup — and the margin — are yours.