[Yandex Cloud documentation](../../../index.md) > [Yandex Certificate Manager](../../index.md) > [Step-by-step guides](../index.md) > Let's Encrypt certificate > Adding a certificate

# Adding a Let's Encrypt® certificate

You can only use a [certificate](../../concepts/managed-certificate.md) from Certificate Manager in the [specific](../../concepts/services.md) Yandex Cloud services.

## Adding a new certificate {#add-certificate}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to add your certificate to.
  1. Navigate to **Certificate Manager**.
  1. Click **Add certificate**.
  1. In the menu that opens, select **Let's Encrypt certificate**.
  1. In the window that opens, enter a name for your certificate in the **Name** field.
  1. Optionally, in the **Description** field, describe the certificate.
  1. In the **Domains** field, list the domains to issue a certificate for.

     Domain names may contain a mask, e.g., `*.example.com`. If so, select `DNS` as the type of domain rights check. For more information, see [Domain rights check](../../concepts/challenges.md#dns).
  1. Select the [type of domain rights check](../../concepts/challenges.md): `DNS` or `HTTP`.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the command description:

     ```bash
     yc certificate-manager certificate request --help
     ```

  1. Run this command:

     ```bash
     yc certificate-manager certificate request \
       --name mymanagedcert \
       --domains example.com
     ```

     Where:
     * `--name`: Certificate name
     * `--domains`: Certificate domains

     Result:

     ```text
     id: fpq6gvvm6piu********
     folder_id: b1g7gvsi89m3********
     created_at: "2020-09-15T08:49:11.533771Z"
     ...
     - example.com
     status: VALIDATING
     updated_at: "2020-09-15T08:49:11.533771Z"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the Terraform configuration file, describe the resource you want to create:

     ```hcl
     resource "yandex_cm_certificate" "le-certificate" {
       name    = "<certificate_name>"
       domains = ["<domain>"]

       managed {
       challenge_type = "<check_type>"
       }
     }
     ```

     Where:
     * `domains`: List of domains you need to create a certificate for.
     * `challenge_type`: [Type of domain rights check](../../concepts/challenges.md) the domain owner should [pass](cert-validate.md). The possible values are:
       * `DNS_CNAME`: Create a [DNS record](../../../dns/concepts/resource-record.md) in [CNAME](../../../dns/concepts/resource-record.md#cname-cname) format with the specified value. We recommend this method for automatic certificate renewal.
       * `DNS_TXT`: Create a DNS record in [TXT](../../../dns/concepts/resource-record.md#txt) format with the specified value.
       * `HTTP`: Place the specified value in the specified URL.

     For more information about the `yandex_cm_certificate` properties, see [this Terraform provider guide](../../../terraform/resources/cm_certificate.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  This will create a certificate in the specified [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). You can check the new certificate and its settings using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

  ```bash
  yc certificate-manager certificate get <certificate_name>
  ```

- API {#api}

  To add a certificate, use the [requestNew](../../api-ref/Certificate/requestNew.md) REST API method for the [Certificate](../../api-ref/Certificate/index.md) resource or the [CertificateService/RequestNew](../../api-ref/grpc/Certificate/requestNew.md) gRPC API call.

{% endlist %}

A new certificate with the `Validating` status will appear in the certificate list. This status means that a request for issuing a Let's Encrypt® certificate has been created. You need to [pass your domain rights checks](cert-validate.md) for the request to be processed.

{% note info %}

For a successful DNS domain rights check based on a `CNAME` record, make sure the `_acme-challenge` subdomain of the domain name you are checking has no other [resource records](../../../dns/concepts/resource-record.md) except `CNAME`. For example, for the `_acme-challenge.example.com.` domain name, there should only be a CNAME record and no TXT record.

{% endnote %}

## Viewing the certificate issue status {#view-statuses}

You can view the certificate issue status and possible issue errors in the [management console](https://console.yandex.cloud):

1. Navigate to **Certificate Manager**.
1. Select the certificate from the list.
   
   You can find the certificate's current issue status next to the **Validation** field.
1. To view the status description and outcome, click ![receipt](../../../_assets/console-icons/receipt.svg) **Show logs**.

   For more information about the certificate issue statuses, see [Let's Encrypt certificate](../../concepts/managed-certificate.md#issue-statuses).

#### Useful links {#see-also}

* [Getting the contents of a Let's Encrypt certificate](cert-get-content.md)
* [Checking domain rights](cert-validate.md)
* [Renewing a certificate](cert-update.md)