SSL: automatic renewal
How automatic certificate renewal works
How a ZRAZU SSL certificate renews on your site by itself: a personal certificate link, a scheduled task on your side and the guide for your hosting.
A ZRAZU subscription certificate is issued in parts: each part is valid for a limited time (currently up to 200 days, and shorter later under industry rules). When the next part is due, we issue it ourselves. For the new certificate to reach your site without any action from you, your server, hosting or cloud has to fetch it on a schedule, once a day.
What you get
- A personal certificate link. In your account, open the certificate card, section "Installation" → "Link for the server". It always points to the current subscription certificate:
https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem(the certificate with intermediates), plushttps://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pemandhttps://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pemseparately. - Your private key stays with you. Later parts of the subscription are issued for the same key, so you place the key once and only the public certificate is renewed after that. The link neither gives out nor accepts a key.
- A scheduled task on your side. A script fetches the certificate from the link once a day and installs it if it is new. The scripts are in each guide below.
We never ask for your hosting passwords, cloud keys or the certificate's private key: your server installs the certificate, not us.
Pick your case
| Where your site runs | Renews by itself | Guide |
|---|---|---|
| Your own Linux server (nginx, Apache, Caddy, HAProxy, Docker) | yes | Linux server |
| Windows Server with IIS | yes | Windows and IIS |
| Kubernetes | yes | Kubernetes |
| Hosting with cPanel (Hostiq, Hostpro, Ukrnames, GoDaddy, Namecheap…) | yes | cPanel |
| AWS: load balancer, CloudFront, API Gateway | yes | AWS |
| Azure: Application Gateway, App Service, Front Door | yes | Azure |
| Google Cloud: load balancer with Certificate Manager | yes | Google Cloud |
| Cloudflare in front of the site | depends on the plan | Cloudflare |
| Hosting with a panel that has no API: hosting.ua (adm.tools), Cityhost, Mirohost, ISPmanager, Plesk, DirectAdmin, Hostinger, Hetzner | manually, we remind you | Hosting panels |
| Site builder: Tilda, Wix, Shopify, Prom, Horoshop… | our certificate is not needed there | Site builders |
Not sure what you have? Open any guide and copy the AI prompt: it will ask about your hosting and walk you through.
How to check that it works
- In the certificate card, next to the link, you can see when your server last fetched the certificate and whether it got the current one.
- Site check: https://zrazu.com/tools/ssl/example.com/ shows which certificate your site serves and until when it is valid.
- We send an email after each new part. If the site still serves the old certificate a few days later, the task on your server did not run: open the task log (each guide says where it is).
Link security
- The link gives out only the public certificate, the same one your site shows every visitor. Still, do not publish it: whoever has the link can see when your server fetches it.
- We show the link once and store only its fingerprint. If you lost it or exposed it, use "New link" in the card: the old one stops working immediately, and you replace the address in the script.
- The link works until the subscription ends. An unknown, disabled or expired link gets the same answer: "not found" (404).