EPP connection in the reseller cabinet

The "Reseller" → "EPP connection" section of the cabinet is where your billing connects to ZRAZU. Logins, passwords, IP addresses, the certificate and safeguards are visible to and managed by the organization's owner, administrators and technicians. The password of a live login is set only by the owner or an administrator.

The section appears after the contract. How to get one: how to become a reseller.

Addresses

• Sandbox: epp-test.zrazu.com, port 1700. Test balance, no real money is charged.
• Live server: epp.zrazu.com, port 700.

The connection is protected by TLS 1.2 or newer. The limits on concurrent sessions and commands per minute are shown in the section itself.

Step 1. Get a sandbox login

You get the sandbox login yourself: one per reseller.

1. Find the "The epp-test sandbox" block.
2. Choose a login: 3–16 characters, Latin letters, digits, hyphen and underscore; the first must be a letter.
3. Enter the IP addresses your billing will connect from: 1 to 20, one per line or comma-separated.
4. Click "Get a sandbox login".
5. Set a password for the login right away (step 2).

Your manager sets up the live login and the response profile after the sandbox check.

Step 2. Set a password

You set the password. We never see it and cannot show it, only reset it at your request.

1. In the "EPP logins" table find your login and click "Set password".
2. Enter the password twice or click "Generate".
3. If the password is generated, copy it into your billing module before you close the window: we cannot show it later.
4. Click "Save password".

Requirements: 16–64 characters, Latin letters, digits and punctuation, no spaces; at least three of four kinds (lowercase, uppercase, digits, symbols); the login must not appear inside the password. 16 characters suit all modules, and the rfc profile cannot take more.

The new password replaces the old one at once. A billing system you have not updated yet loses access to the login. Prepare the module settings first, then confirm.

Step 3. IP addresses and certificate

An IP allow list is required: a connection from an address that is not in the list is closed. Add the outgoing address of your billing server to every login: the "Configure" button in the logins table.

You can add a public IPv4 or IPv6 address, or a network no wider than /24 (/64 for IPv6).

A client certificate is optional. Create the key and the certificate on your side and upload only the certificate: the private key stays with you. The server checks the certificate fingerprint at sign-in. For the Hostmaster namespaces the certificate is required.

Every change to addresses or the certificate closes the login's open sessions and is emailed to owners and administrators.

Safeguards

• Mass actions. If the number of transfer codes, NS changes and owner changes per hour or per day goes over the threshold, the next commands are not rejected: they wait for your confirmation in the "Awaiting confirmation" block at the top of the section. Confirming needs two-factor authentication; refusing is immediate. If you do not decide, the command is dropped after a few hours and your billing gets the outcome in poll.
• Login hijack guard. An owner change under the contact lock, unlocking or a transfer code within 72 hours of an owner change needs your confirmation.
• Daily summary. How many transfer codes, NS changes and owner changes were done during the day.
• "Revoke access". A button in the section: all sessions close and the passwords of all logins are replaced. Billing stops working with ZRAZU until you set new passwords. IP addresses and certificates stay.

EPP manual and portfolio transfer

• EPP manual: the full partner manual with commands, response codes, the sandbox and security. It is in Ukrainian, and the cabinet shows it inside the page frame. The same roles see it as the "EPP connection" section.
• Portfolio transfer: domains from another provider are moved in a batch of "domain ; code" at the wholesale price. A domain cannot be moved without its code.

WHMCS has ready-made modules: modules for WHMCS.

If it didn't work

• The connection is closed with code 2501. Your server's address is not in the login's allow list. Add it under "Configure".
• "The login … is already taken — choose another name". Choose a different login.
• "You already have a sandbox login — a reseller gets only one". Set a password for the existing login or change its IP addresses.
• "Enter 1 to 20 public IP addresses". Private and invalid addresses are not accepted.
• "The passwords do not match" or "The password must be 16 to 64 characters long". Check both fields.
• "File not accepted: it is too large for a certificate". Upload the certificate itself (BEGIN CERTIFICATE), not a chain or an archive.
• The section does not open or is empty. Only the owner, administrators and technicians of a reseller organization see it. If you are a reseller and have no access, write to your manager.