SSL: automatic renewal

Certificate link — developer reference

Addresses, formats, response codes, conditional requests, limits and security rules of the personal certificate link — for your own integrations and AI agents.

The personal link gives the current subscription certificate without signing in to your account — for scripts, scheduled tasks and your own integrations. You create it in your account: certificate card → "Installation" → "Link for the server".

Addresses

https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN is the base address; the file name is added to it:

RequestWhat it returns
GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pemthe site certificate followed by the CA's intermediate certificates — for nginx, Apache 2.4.8+, Caddy, HAProxy, Kubernetes
GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pemthe site certificate only
GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pemthe intermediate certificates only

The response type is application/x-pem-file, PEM text. The link neither gives out nor accepts a private key: the key stays with you, and later parts of the subscription are issued for the same key.

What is served

The current version of the subscription is the latest issued certificate. If it is revoked or expired, the link answers 404: we do not fall back to the previous version, because the certificate authority may have revoked it on replacement. When the next part of the subscription appears, the same link starts serving it — you do not need to change the link.

If the certificate was reissued with a new key, the link will serve a certificate for the new key. So before installing, compare the certificate's public key with your private key, as all the scripts in our guides do:

openssl x509 -in fullchain.pem -noout -pubkey | openssl sha256
openssl pkey -in key.pem -pubout | openssl sha256

The lines must match.

Response codes

CodeWhen
200the certificate is in the response body
304conditional request, the certificate has not changed
404the link is unknown, disabled or expired, or the subscription has no current certificate right now — the response is the same, so it does not reveal whether the link existed
429too many requests; the Retry-After header says in how many seconds you can try again

Conditional requests

The response contains ETag (changes with the certificate version) and Last-Modified (issue time). A request with If-None-Match or If-Modified-Since gets 304 while the certificate is the same:

curl -fsS --etag-save etag.txt --etag-compare etag.txt -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem"

Conditional requests are optional: the file is small, and comparing it with the installed one (cmp) is just as easy.

Limits

  • 60 requests per hour per link — plenty for a task that runs once a day or even once an hour;
  • 300 requests per minute from one IP address.

Security

  • Treat the link as a "do not publish" secret: it gives out only the public certificate, but whoever has it can see when the certificate is fetched.
  • Responses are not cached (Cache-Control: no-store), not indexed, and do not pass the link in Referer.
  • We show the link once; only its fingerprint is stored on our side. A new link in the certificate card immediately disables the previous one; "Disable" is in the same place.
  • The link works until the subscription ends.

For AI agents

The full ZRAZU documentation in a format for language models: https://zrazu.com/llms.txt (table of contents) and https://zrazu.com/llms-full.txt (all pages). Every documentation page is also available as Markdown — add .md to the address without the trailing slash.

This page in Markdown