# Certificate link — developer reference

> Addresses, formats, response codes, conditional requests, limits and security rules of the personal certificate link — for your own integrations and AI agents.

URL: https://zrazu.com/en/docs/ssl-auto-pull-api/

The personal link gives the current subscription certificate without signing in to your account — for scripts, scheduled tasks and your own integrations. You create it in your account: certificate card → "Installation" → "Link for the server".

## Addresses

`https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN` is the base address; the file name is added to it:

| Request | What it returns |
| --- | --- |
| `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem` | the site certificate followed by the CA's intermediate certificates — for nginx, Apache 2.4.8+, Caddy, HAProxy, Kubernetes |
| `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` | the site certificate only |
| `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem` | the intermediate certificates only |

The response type is `application/x-pem-file`, PEM text. The link neither gives out nor accepts a private key: the key stays with you, and later parts of the subscription are issued for the same key.

## What is served

The current version of the subscription is the latest issued certificate. If it is revoked or expired, the link answers `404`: we do not fall back to the previous version, because the certificate authority may have revoked it on replacement. When the next part of the subscription appears, the same link starts serving it — you do not need to change the link.

If the certificate was reissued with a new key, the link will serve a certificate for the new key. So before installing, compare the certificate's public key with your private key, as all the scripts in our guides do:

```sh
openssl x509 -in fullchain.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256
```

The lines must match.

## Response codes

| Code | When |
| --- | --- |
| `200` | the certificate is in the response body |
| `304` | conditional request, the certificate has not changed |
| `404` | the link is unknown, disabled or expired, or the subscription has no current certificate right now — the response is the same, so it does not reveal whether the link existed |
| `429` | too many requests; the `Retry-After` header says in how many seconds you can try again |

## Conditional requests

The response contains `ETag` (changes with the certificate version) and `Last-Modified` (issue time). A request with `If-None-Match` or `If-Modified-Since` gets `304` while the certificate is the same:

```sh
curl -fsS --etag-save etag.txt --etag-compare etag.txt -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem"
```

Conditional requests are optional: the file is small, and comparing it with the installed one (`cmp`) is just as easy.

## Limits

- 60 requests per hour per link — plenty for a task that runs once a day or even once an hour;
- 300 requests per minute from one IP address.

## Security

- Treat the link as a "do not publish" secret: it gives out only the public certificate, but whoever has it can see when the certificate is fetched.
- Responses are not cached (`Cache-Control: no-store`), not indexed, and do not pass the link in `Referer`.
- We show the link once; only its fingerprint is stored on our side. A new link in the certificate card immediately disables the previous one; "Disable" is in the same place.
- The link works until the subscription ends.

## For AI agents

The full ZRAZU documentation in a format for language models: [https://zrazu.com/llms.txt](https://zrazu.com/llms.txt) (table of contents) and [https://zrazu.com/llms-full.txt](https://zrazu.com/llms-full.txt) (all pages). Every documentation page is also available as Markdown — add `.md` to the address without the trailing slash.