# ZRAZU > ZRAZU is a Ukrainian domain and SSL registrar: .UA and international domains, DNS, SSL with automatic renewal, a customer cabinet. Below is documentation for people and AI agents; every page is also available as Markdown. ## Domains - [How to register a domain](https://zrazu.com/en/docs/domains-register.md): Find a free name, add it to the cart, choose the owner, accept the registry documents and pay. A domain usually becomes yours in under a minute. - [Transferring a domain to ZRAZU](https://zrazu.com/en/docs/domains-transfer-in.md): How to move a domain from another registrar: check, transfer code, DNS choice, payment and timing. What to do if the code was rejected. - [Renewing a domain and auto-renew](https://zrazu.com/en/docs/domains-renew.md): How to renew a domain by hand, turn on auto-renew from your balance, which reminders we send and how to let a domain go on purpose. - [Domain owner and contacts](https://zrazu.com/en/docs/domains-owner-contacts.md): How to create a contact, assign the owner and change it: a 72-hour pause, the new owner's consent within 14 days, and what WHOIS shows. - [Transferring a domain away from ZRAZU](https://zrazu.com/en/docs/domains-transfer-out.md): How to get a transfer code to move a domain to another registrar: remove the lock, request the code in the cabinet and why it arrives only by email. - [Bulk actions on domains](https://zrazu.com/en/docs/domains-bulk.md): How to change auto-renew, reminders, the transfer lock or name servers for many domains at once, stop a batch and roll the changes back. ## DNS - [DNS zone on ZRAZU servers — how to turn it on](https://zrazu.com/en/docs/dns-zone.md): Free DNS on ZRAZU servers: which name servers to use, how to turn the zone on for a domain, edit records, undo a change and restore an earlier revision. - [DNS records for a site and mail — examples](https://zrazu.com/en/docs/dns-records.md): Which records to add for a website (A, AAAA, CNAME) and mail (MX, SPF, DKIM, DMARC) in a ZRAZU DNS zone, with ready examples and a note on every field. - [A domain at another registrar, and Cloudflare](https://zrazu.com/en/docs/dns-external.md): How to run a DNS zone on ZRAZU servers for a domain at another registrar, set your own name servers and connect Cloudflare with an API key in the cabinet. - [DNSSEC for a domain on ZRAZU servers](https://zrazu.com/en/docs/dns-dnssec.md): How to turn DNSSEC on and off for a domain on ZRAZU DNS: what zone signing is, where to get the DS record and what to do with a DS left by a previous provider. - [Forward a domain to another address](https://zrazu.com/en/docs/dns-forward.md): How to set up domain forwarding on ZRAZU: the root and www open the address you give, with code 301 or 302, keeping the path and parameters or not. ## SSL certificates - [SSL certificate types at ZRAZU](https://zrazu.com/en/docs/ssl-overview.md): DV, Wildcard, Multi-domain, OV and EV: how the certificates differ, when the free one is enough, and how the 1-year subscription renews in parts. - [Ordering and activating a certificate](https://zrazu.com/en/docs/ssl-order.md): How to order a paid SSL in the cabinet: domain, CSR with your own key, extra names, payment in any way. How to activate after paying. - [Domain validation for a certificate](https://zrazu.com/en/docs/ssl-dcv.md): How to prove the domain is yours: a DNS record, a file on the site or an email. Automatic record for domains on ZRAZU DNS and in Cloudflare, common errors. - [Certificate files and server installation](https://zrazu.com/en/docs/ssl-files.md): Which files ZRAZU gives after issuance: fullchain, cert, chain. How to build a PFX for IIS and Windows and where to put them. The private key stays with you. - [Reissuing and revoking a certificate](https://zrazu.com/en/docs/ssl-reissue.md): When to reissue a certificate with a new CSR, what happens to the term and payment, how to revoke a certificate if the key leaked, and about refunds. - [ACME for certbot, acme.sh and Caddy](https://zrazu.com/en/docs/ssl-acme.md): How a server issues and renews a certificate on its own: the ZRAZU ACME server for paid certificates and acme-dns for free ones, wildcard included. ## SSL: automatic renewal - [How automatic certificate renewal works](https://zrazu.com/en/docs/ssl-auto.md): How a ZRAZU SSL certificate renews on your site by itself: a personal certificate link, a scheduled task on your side and the guide for your hosting. - [Linux server — nginx, Apache, Caddy, HAProxy, Docker](https://zrazu.com/en/docs/ssl-auto-linux.md): A script for nginx, Apache, Caddy, HAProxy and Docker fetches the fresh certificate daily, checks it against your key and reloads the server with no downtime. - [Windows Server and IIS](https://zrazu.com/en/docs/ssl-auto-windows-iis.md): A Windows Task Scheduler task fetches the fresh certificate once a day, links it to the key in the Windows store and binds it to the IIS site. - [Kubernetes — the certificate in a TLS secret renews by itself](https://zrazu.com/en/docs/ssl-auto-kubernetes.md): A CronJob fetches the fresh certificate once a day and updates the TLS secret your ingress uses; the key stays in that same secret. - [Hosting with cPanel — the certificate renews by itself](https://zrazu.com/en/docs/ssl-auto-cpanel.md): A cron job in cPanel fetches the fresh certificate once a day and installs it on your site with cPanel's built-in tool. No SSH needed. - [Hosting panels without automation — renew by hand](https://zrazu.com/en/docs/ssl-auto-panels-manual.md): adm.tools, Cityhost, Mirohost, ISPmanager, Plesk, DirectAdmin, Hostinger, Hetzner: where in the panel to replace the certificate and what to paste. - [AWS — load balancer, CloudFront, API Gateway](https://zrazu.com/en/docs/ssl-auto-aws.md): A Lambda function fetches the fresh certificate daily and reimports it into AWS Certificate Manager under the same ARN — ELB and CloudFront follow. - [Azure — Application Gateway, App Service, Front Door](https://zrazu.com/en/docs/ssl-auto-azure.md): An Azure Automation runbook fetches the fresh certificate once a day and adds a new version to Key Vault, and Azure services pick it up on their own. - [Google Cloud — load balancer with Certificate Manager](https://zrazu.com/en/docs/ssl-auto-gcp.md): A Cloud Run job started by Cloud Scheduler once a day updates the certificate in Certificate Manager in place, and the load balancer picks it up on its own. - [Cloudflare in front of your site](https://zrazu.com/en/docs/ssl-auto-cloudflare.md): Site behind Cloudflare: on Free and Pro our certificate sits on your server; on Business and Enterprise a script renews it in Cloudflare via the API. - [Site builders — Tilda, Wix, Shopify, Prom, Horoshop and others](https://zrazu.com/en/docs/ssl-auto-site-builders.md): Tilda, Wix, Shopify, Prom, Horoshop and other site builders issue a free certificate themselves and don't accept another one — no need to buy SSL. - [Certificate link — developer reference](https://zrazu.com/en/docs/ssl-auto-pull-api.md): Addresses, formats, response codes, conditional requests, limits and security rules of the personal certificate link — for your own integrations and AI agents. ## Monitoring - [What ZRAZU monitoring checks](https://zrazu.com/en/docs/monitoring-checks.md): Monitoring watches your domain, delegation, DNSSEC, certificate, mail and website, and writes to you only when something is really broken. - [Add domains to monitoring and the plan](https://zrazu.com/en/docs/monitoring-add.md): How to put domains from other registrars on monitoring with a list, a CSV file or Cloudflare, and how the free and paid monitoring plans work. - [Monitoring notifications and incidents](https://zrazu.com/en/docs/monitoring-alerts.md): Where domain alerts go, how to connect email, Telegram or a webhook, set quiet hours, and what to do when an incident is opened. ## Account and payment - [Getting started: sign-up, sign-in, organization](https://zrazu.com/en/docs/account-start.md): How to create a ZRAZU account, sign in with a password, an email link or a passkey, create an organization and switch between organizations in the dashboard. - [Team and roles in an organization](https://zrazu.com/en/docs/account-team.md): How to invite a colleague to your organization, which role to give, what each role can do, how to change a role or remove a person and where the sign-in log is. - [Sign-in security: passkey, code, sessions](https://zrazu.com/en/docs/account-security.md): How to protect a ZRAZU account: add a passkey or an app code, save backup codes, change the password and email, close other sessions and recover access. - [Balance and payment: card and IBAN invoice](https://zrazu.com/en/docs/account-balance.md): How to top up your ZRAZU balance by card or by an IBAN invoice, save a card, pay for an order, and what to do if a payment didn't go through. - [Invoices, acts and payers](https://zrazu.com/en/docs/account-documents.md): How to add a payer so invoices and acts are issued to a company or sole proprietor, where to find and download them and how to export the money history as CSV. - [Contacting support from the dashboard](https://zrazu.com/en/docs/account-support.md): How to write to ZRAZU support from the dashboard, email or Telegram, what to include in a request, how to follow the reply and what support never does. ## API and MCP - [ZRAZU API — developer overview](https://zrazu.com/en/docs/api-overview.md): Base address, key sign-in, idempotency, error format and limits of the ZRAZU API — for your own scripts, integrations and AI agents. - [API keys — how to create and restrict](https://zrazu.com/en/docs/api-keys.md): How to create an API key in the ZRAZU cabinet, choose its rights, domains, IP addresses and term, and revoke the key if it ends up in the wrong hands. - [Domains and DNS through the API — examples](https://zrazu.com/en/docs/api-domains-dns.md): Examples of ZRAZU API requests: list domains, monitoring, read a DNS zone, change records, create a zone and check delegation. - [MCP for AI agents — domain passport](https://zrazu.com/en/docs/api-mcp.md): How to connect the ZRAZU MCP server to Claude, ChatGPT or Cursor: the address, the domain passport tool, limits and what the agent never sees. ## Resellers and studios - [How to become a ZRAZU reseller](https://zrazu.com/en/docs/resellers-program.md): How to sell .UA domains and SSL from your own billing at wholesale prices: the form in the cabinet, the contract, the sandbox and the live login. - [EPP connection in the reseller cabinet](https://zrazu.com/en/docs/resellers-epp.md): How a reseller creates a sandbox login, sets a password, adds IP addresses and a certificate, confirms mass actions and revokes access in the ZRAZU cabinet. - [Reseller price list in the cabinet](https://zrazu.com/en/docs/resellers-prices.md): Where a reseller sees wholesale domain and SSL prices next to storefront retail prices, what currency they are in, how to read the table and why it is current. - [ZRAZU modules for WHMCS](https://zrazu.com/en/docs/resellers-whmcs.md): How a reseller installs the "ZRAZU Domains" and "ZRAZU SSL" modules in WHMCS: download the archive, test in the sandbox and issue a key for live mode. - [Web studio cabinet](https://zrazu.com/en/docs/resellers-studio.md): How a web studio manages clients' domains in one ZRAZU cabinet: joining, a tier by domain count, clients, prices, a monthly statement and transfers. --- # How to register a domain URL: https://zrazu.com/en/docs/domains-register/ Registering a domain takes four steps: search, cart, checkout and payment. Everything happens in the [cabinet](https://vse.zrazu.com/domains/new/). For first-year prices, see the [prices page](https://zrazu.com/prices/) and the search results. There are no figures here, so they never go out of date. ## What you need - An account and an organization in the cabinet. - A role with the right to pay: only such a role can add domains to the cart. - An owner contact in the "Contacts" book (step 4 below). If you do not have one yet, create it beforehand: [Domain owner and contacts](https://zrazu.com/en/docs/domains-owner-contacts.md). ## Step by step 1. Open **Domains → New domain**. 2. In the "Name or domain" field, enter a name, for example `kava`, and click **Search**. You can also enter a full address, for example example.com. 3. Look through the list of zones. Free domains have an add-to-cart button (**Add**). If a domain is taken, click **Watch** and we will tell you when it becomes free. The search has filters for groups of zones: Ukrainian, international and new. 4. The cart opens on the right. Click **Checkout**. The "Name" step asks you to choose the domain owner: a person, or an organization or sole proprietor. 5. Tick **I accept the documents below**. These are the offer and the registry documents for the zones in your order (for `.UA`, the registry regulations). We keep the versions of the documents together with the order. 6. Pay from your balance or by a bank invoice. For invoice payment, see the "Billing" section of the cabinet. 7. Wait for the "Done" step. Registration usually takes up to a minute. The message "The domain is yours." means everything went through. ## Who can be the owner The owner (the registry calls them the registrant) holds the right to the domain. It can be: - a **person**: first and last name; - an **organization or sole proprietor**: a name, and the EDRPOU or RNOKPP code. This affects WHOIS, the registry's public directory. A private individual's data is hidden. An organization's or sole proprietor's data is shown in full: name, address, email and phone. You can change the owner later, but it takes 72 hours. In the "Contacts" book you cannot choose an entry marked "incomplete address". Add the street, city and country in the contact's card. ## If it didn't work | What you see | What to do | | --- | --- | | "We don't sell this zone right now" | Choose another zone. | | "We don't sell the .укр zone" | This zone is unavailable. Choose another one. | | No add-to-cart button, a note about the role | Ask an organization owner or administrator to add the domain: a role with the right to pay is required. | | The list of owners is empty | Create a contact in **Domains → Contacts**: owners and administrators of the organization create them. | | "It didn't work: the ZRAZU team returned the money to your balance" | The registry rejected the registration. The money is already on your balance, so you can try another name. | | "It didn't work: the ZRAZU team is looking into it" | The team will return the money to your balance or submit the request again. You don't need to do anything. | | "The registry is responding more slowly than usual" | You can close the page: the domain's status will be in "All domains". | | The bank has not confirmed the payment yet | If you did not finish paying, pay again. If the money was charged, write to support with the order number. | --- # Transferring a domain to ZRAZU URL: https://zrazu.com/en/docs/domains-transfer-in/ A transfer moves a domain from another registrar to you at ZRAZU. A transfer adds a year to the domain's current term. After the transfer we set the transfer lock and put the domain under monitoring. For the transfer price, see the [prices page](https://zrazu.com/prices/). ## Before you start A domain can be transferred when all of these conditions are met: - The current registrar has **removed the transfer lock** (and the change lock, if there is one). Remove it in their cabinet. - **60 days** have passed since registration or the previous transfer. - The domain is not being deleted and is not being moved to someone else right now. - The domain is in a zone we transfer. You will see this during the check. - You have the **transfer code**. The current registrar gives it in their cabinet or on request. It is a secret: enter it only in the cabinet form and never send it in correspondence or chat. If the domain is close to expiry or has even expired but is not being deleted, you can still transfer it: the transfer extends the domain by a year. ## Step by step 1. Open **Domains → Transfer**. 2. Enter a domain on the **One domain** tab or paste several on the **List** tab (one per line, comma-separated, or a CSV column with the domain first). One check covers up to 30 domains, with up to 10 checks per hour. 3. Click **Check the domain** (for a list, **Check domains**). We only look at what the registry says and change nothing. 4. For each domain you will see its state and a hint. If the domain is ready, enter the transfer code in the "Code" field. You can add the code later. 5. Click **Proceed to checkout**. An organization owner, administrator or accountant can add to the cart. 6. Choose what to do with DNS after the transfer (see below). Without this choice the transfer will not go further. 7. Accept the documents and pay for the order. The money for a transfer is taken when the registry gives its final answer. A code left in an unpaid cart is erased after 14 days. ## DNS after the transfer The "DNS after the transfer" window shows where your domain's name servers are now and whether it has records. There are two options: - **Keep these name servers**: the site and mail keep working where they are now. We change nothing. If the domain is currently on the previous registrar's DNS, that registrar will switch it off after the transfer and the site and mail will stop working. In that case we ask you to confirm separately that you understand this. - **Move to ZRAZU DNS**: we show the zone records we found. Remove what you don't need, add what you do, and tick **I checked the records**. We apply the zone right after the transfer. The snapshot of records may be incomplete, so check it carefully, especially subdomains and DKIM. You can change the choice with **Change choice**. For several domains there is a **Keep name servers for all** button. You can edit the zone later in the domain's card. ## How long it takes The registry passes the request to the current registrar, who has up to 5 days to answer. If it stays silent, the registry approves the transfer itself. To speed it up, ask the current registrar to confirm the transfer. This is optional. The state is visible in "All domains": "Sending to the registry", "Moving to ZRAZU", "Needs attention". The date by which the transfer will complete is shown there too. ## Transferring many domains If you have many domains, use the **List** tab in step 2. If you don't want to transfer but only monitor a domain, the form has a "Just watch" mode (up to 25 domains free). ## If it didn't work | What you see | What to do | | --- | --- | | "The current registrar has set a transfer lock" | Remove the lock in the current registrar's cabinet and add the domain again. | | "can be transferred from …: 60 days after registration" | Wait for the date shown. | | "The domain is being deleted" | It cannot be transferred: only the current registrar can restore it. Transfer after that. | | "Already being transferred to another registrar" | Wait for that to finish, or cancel that transfer at that registrar. | | "Not registered" | The domain is free: you can register it. | | "Already in your cabinet" | No transfer is needed. | | "We do not sell this zone yet" | We don't transfer this zone. | | "The transfer code is 6 to 80 Latin letters, digits and signs without spaces" | Copy the code again, without spaces at the edges. | | "The code was rejected" | Get a new code from the current registrar, enter it in "All domains" in the "New transfer code" field and click **Send again**. | | "The current registrar rejected the transfer" | Ask them why, ask them not to reject the next request, get a new code. | | "The transfer failed" | The money stays on your balance. The ZRAZU team will contact you. | --- # Renewing a domain and auto-renew URL: https://zrazu.com/en/docs/domains-renew/ A domain is valid until a certain date. If you don't renew it, it stops working after that date, and later it is deleted from the registry and someone else can take the name. You can renew by hand or leave it to auto-renew. You see the renewal amount in the cart before paying. There are no figures here: see the [prices page](https://zrazu.com/prices/). ## Renewing by hand 1. Open **Domains → All domains** and choose a domain. 2. Click **Renew** (the button is at the top of the card and in the "Term and renewal" block). 3. Choose how many years, and the mode: with or without VAT, depending on the payer. 4. Confirm in the cart and pay. After payment, the card shows "New term until …". The term cannot be longer than 9 years from today. Renewals are non-refundable. Roles with the right to pay can renew and turn auto-renew on or off. ## Auto-renew With auto-renew on, we charge the organization's balance 30 days before the term ends, at that day's rate. If it fails (for example, not enough money), we retry 7 days and 1 day before the end. Keep enough money on your balance. The switch is in the domain's card, in the "Term and renewal" block (**Auto-renew**). Turning auto-renew off is deliberately harder: you must type the domain name and confirm with a code from the app or a passkey. This way nobody switches it off by accident. ## Expiry reminders We send emails 60, 30, 15, 7 and 1 day before the term ends, and every day after it until the domain is renewed. You can turn the reminders off; then we write only on the day the domain is deleted. ## Let the domain go If you no longer need the domain, use **Let the domain go…**. We turn off auto-renew and reminders. After the term ends the domain is deleted from the registry. To avoid mistakes, you must type the domain name and a code from the app or a passkey. If you change your mind before the term ends, turn auto-renew on again. ## Several domains at once You can change auto-renew and reminders for many domains at once: [Bulk actions](https://zrazu.com/en/docs/domains-bulk.md). ## If it didn't work | What you see | What to do | | --- | --- | | "The term is already at the limit: a renewal can reach no further than 9 years from today" | You don't need to renew now: the term is already long. | | "The term is still being checked with the registry" | Wait a little and refresh the page. | | "Auto-renew for this term is already paid" | Do nothing: the domain is already being renewed. | | "The last day of renewal has passed: the domain is being deleted from the registry" | Renewal is no longer possible. If you need the domain, write to support. | | "Renewal was stopped by an operator" | The switch and the button don't work until renewal is restored. Write to support. | | The domain is "frozen during a dispute" | Renewal continues as usual, but contacts, name servers and locks do not change. | | The auto-renew charge failed | Top up your balance: we will retry 7 days and 1 day before. | --- # Domain owner and contacts URL: https://zrazu.com/en/docs/domains-owner-contacts/ Every domain has an owner (the registrant) and contacts: administrative, technical and billing. The owner holds the right to the domain, so changing it is harder than changing the other contacts. ## The "Contacts" book A contact is data for a domain, not access: it has no cabinet login. To give colleagues access, use the "Team" section. Contacts are created and managed by the organization's owner and administrators. 1. Open **Domains → Contacts** and click **New contact**. 2. Choose the type: a **person** (name) or an **organization or sole proprietor** (also fine for SSL verification). 3. Fill in the email, phone and address. 4. Click **Create contact**. Field rules: - name or title: up to 120 letters; - email: in Latin letters, like name@example.com; - phone: digits with the country code, for example +380 44 123 45 67; - the EDRPOU code (8 digits) or a sole proprietor's RNOKPP (10 digits) is given only for an organization or sole proprietor; - postal code in Ukraine: 5 digits. The book can hold up to 200 contacts, and no more than 50 new ones per day. A contact that is set on domains cannot be deleted: first replace it with another one there. ## What WHOIS shows WHOIS is the registry's public directory. A private individual's data is hidden (name, address, email, phone). An organization's or sole proprietor's data is published in full. The **Owner** tab of the domain card has a block "What WHOIS shows". ## Changing the administrative, technical or billing contact 1. Open the domain card, the **Owner** tab. 2. In the "Domain contacts" block, click **Replace** next to the role, choose an entry from the book and click **Apply**. These contacts change immediately. Both the new and the previous contacts receive a letter about the change. If the contact lock is on, first remove it on the **Security** tab: this takes 72 hours. ## Changing the owner The owner is changed on the **Owner** tab, in the "Irreversible actions" block (**Change the owner…**). This change is protected against hijacking: 1. Choose the new owner from the book, read the statement (**Show the statement**) and type the domain name to confirm. Then confirm with a code from the app or a passkey. 2. The new owner receives a letter and must agree within 14 days. They open the link from the letter: no cabinet login is needed. Opening the page is not consent: the statement text is shown first, and consent is confirmed with a separate button (or they decline). 3. The change takes effect 72 hours after consent. Until then the current owner stays, and all contacts and the organization's owners have received a letter and can cancel the change (**Cancel**). 4. For another 72 hours after the change we do not issue the domain's transfer code. For some zones the zone administrator requires a written statement: then after confirming you must upload a `.p7s` signature file over the statement text (a qualified electronic signature). The file must not exceed 256 KB. If no owner is set yet, the first assignment applies immediately, without a pause. If you change the owner of a domain whose data is tied to a trademark, the data must match the trademark certificate. ## If it didn't work | What you see | What to do | | --- | --- | | "Email should look like name@example.com" | Enter the email in Latin letters, without spaces. | | "EDRPOU is 8 digits, a sole proprietor's RNOKPP is 10 digits" | Check the code. | | "The contact is set on domains … Replace it there first" | Assign another contact on those domains, then delete. | | "Domain contacts are managed by the organization's owner and administrators" | Ask them to make the change. | | "Such a change is already planned: wait for it or cancel it" | Cancel the earlier change or wait for it to complete. | | "The statement text changed: please read it again" | Open the statement again and confirm. | | The domain is frozen during a dispute | Contacts, name servers and locks do not change until the parties, a court or UDRP decide. | --- # Transferring a domain away from ZRAZU URL: https://zrazu.com/en/docs/domains-transfer-out/ A domain is not tied to us forever: you can move it to any other registrar. For this you need a transfer code. It is a secret, so we do not show it on screen but email it to the domain owner (the registrant). Nobody, support included, asks for the code in a chat. You choose the new registrar yourself: they will tell you where to enter the code. ## Before you start - A role with the right to take a domain out: in the cabinet this is the organization owner (an administrator does not have this right). - The domain has an owner (a registrant): without one there is nobody to send the code to. - The domain is not frozen during a dispute over rights. - 72 hours have passed since the last change of owner, password, email or contacts. - If DNSSEC is on at ZRAZU servers, turn it off on the **DNS** tab and wait for it to be removed (up to two days). Otherwise the domain may stop opening after the transfer. ## Step by step 1. Open the domain card: **Domains → All domains**, then the domain. 2. On the **Security** tab, turn off the **Transfer lock**. Confirm with a code from the app or a passkey. 3. On the **Owner** tab find the **Transfer code** block and click **Email the code to the owner**. Confirm again. 4. You will see "Request accepted: the code will be emailed to …". Open the letter in the owner's mailbox. 5. Enter the code at the new registrar and confirm the transfer there. You can request the code once a day: while a request is not completed, we do not accept another. The code itself is not stored in our database. ## Good to know - Before leaving, make sure DNS and mail are set up at the new place. You can do this in advance. - If you no longer need the domain, you don't have to transfer it: see "Let the domain go" in [Renewing a domain and auto-renew](https://zrazu.com/en/docs/domains-renew.md). ## If it didn't work | What you see | What to do | | --- | --- | | The transfer lock is on | Remove it on the **Security** tab, then request the code. | | "The transfer code has already been requested: the letter will go to the domain's registrant. You can repeat it in a day" | Check the registrant's mailbox, including "Spam". You can send a new request in a day. | | "After an owner change we hold the code for 72 hours — until …" | Wait for the date shown. This is how we protect the domain from hijacking. | | "DNSSEC is on for the domain at ZRAZU servers…" | Turn DNSSEC off on the **DNS** tab and wait up to two days. | | "The domain has no registrant contact: nobody to send the code to" | Assign an owner: [Domain owner and contacts](https://zrazu.com/en/docs/domains-owner-contacts.md). | | "The domain is frozen during a dispute over rights" | There is no transfer until the parties, a court or UDRP decide. | | "Account access recovery is in progress" | We do not issue the code until the recovery is complete. | | "The person who requested the code no longer has the right to do so" | Repeat the request from the organization owner's account. | --- # Bulk actions on domains URL: https://zrazu.com/en/docs/domains-bulk/ If you have many domains, you don't have to open each one. Select them in the list and run one action for all of them. This is called a batch. ## What you can do in a batch - turn auto-renew on or off; - remind or not remind about the term; - not renew, that is, let the domains go; - set the transfer lock (a batch cannot remove the lock: that is done in each domain's card); - change name servers. One batch holds up to 1000 domains unless another limit has been set for you. ## Step by step 1. Open **Domains → All domains** and tick the domains you need. 2. Actions appear above the table. Choose the one you need. 3. We build a **plan** and check every domain before the start: "can" or "already so, nothing will change". Nothing has been changed yet. 4. Review the plan in **Domains → Bulk actions**. If all is well, click **Start**. If not, **Cancel plan**. 5. The batch runs one domain at a time. You can stop it between domains with **Stop**. 6. For each domain you see the result: changed, no change, failed. Actions that can lead to losing a domain (turning off auto-renew or reminders, letting go, changing name servers) need a fresh confirmation with a code from the app or a passkey. All organization owners receive a letter about turning off auto-renew and changing name servers. ## Batch states | State | What it means | | --- | --- | | Waiting to start | The plan is checked, nothing changed yet. | | Running | Domains are processed one at a time. | | Stopped | The batch was stopped, the remaining domains were not started. | | Finished | All domains are processed. | | Rolled back | The changes were undone. | | Plan cancelled | Nothing was changed. | ## Rollback and retry - **Retry failed**: queues the domains where it did not work. - **Roll back**: returns the previous state. A finished batch can be rolled back for 30 days. The transfer lock has no rollback. - The "Bulk actions" page keeps the last 50 batches. ## If it didn't work | What you see | What to do | | --- | --- | | "Failed" next to a domain | Open the batch and read the reason, then click **Retry failed**. | | The domain is frozen during a dispute | It is skipped: nothing changes while the dispute lasts. | | The action is unavailable | Each action needs its own role: auto-renew and letting go need the right to pay, locks and name servers need separate rights. | | A bulk name server change will not start after access recovery | Name servers cannot be changed for 72 hours after access recovery. | --- # DNS zone on ZRAZU servers — how to turn it on URL: https://zrazu.com/en/docs/dns-zone/ DNS is the domain's "address book": it tells the internet where your site lives and where to send mail. You can run it on ZRAZU servers for free, both for domains registered with us and for domains at other registrars. ## Our name servers Every zone is served by three servers: ```text ns1.zrazu.net ns2.zrazu.net ns3.zrazu.net ``` The zone works once the domain uses exactly these servers. Until then, the internet does not see the records from the editor. ## How to turn it on for a ZRAZU domain 1. Open the [cabinet](https://vse.zrazu.com/domains/) and go to the domain. 2. Open the **DNS** tab. 3. Click **Turn on ZRAZU DNS**. We will copy the current records of the domain root, `www` and mail. 4. Check what was copied and click **Move the domain to ZRAZU servers**. 5. Wait. The registry accepts the change, and the internet sees it within a day. After turning it on, check subdomains and DKIM keys: we copy the root, `www`, mail and common selectors. Add anything missing by hand. If a record cannot be accepted as it is, the cabinet lists it under "Not copied". A domain at another registrar follows a different path, see [DNS for domains at other registrars and Cloudflare](https://zrazu.com/en/docs/dns-external.md). ## All zones in one place In the cabinet menu open **DNS → All zones**: all zones of your organization, their status (for example "Working", "Awaiting NS change", "Suspended"), DNSSEC and dates. You can search by name and filter: all, ZRAZU, other registrars. ## The record editor The editor works through a draft: you change records, see what exactly will change, and only then apply. 1. On the domain's **DNS** tab add a record with **Add a record** or edit an existing one in its row. 2. Fill in **Name**, **Type**, **Value**, **TTL** (and **Priority** for MX and SRV). Use `@` as the name for the domain itself. 3. Look at **What will change**: what is added, removed, or gets a new TTL. The cabinet highlights errors before saving. 4. Click **Apply**. The change gets a revision number and is usually published within a minute. Shortcuts: - **Quick setup**: templates for mail (Google, Microsoft, DMARC) and a website (GitHub Pages, Vercel). A template only adds records to the draft; nothing changes until **Apply**. - **Paste from a zone file**: paste zone file lines or "name type value". You can also **Upload a zone file** (up to 100 KB). - **Download the zone file** to keep a copy of the current state. ### Record types and limits We support A, AAAA, CNAME, MX, TXT, CAA, NS and SRV. A zone can hold up to 500 records. For what to put in each type see [typical records for a site and mail](https://zrazu.com/en/docs/dns-records.md). | Field | Rule | | --- | --- | | TTL | From 60 seconds to a day. Default is 3600 (one hour) | | Priority | A whole number from 0 to 65535 (for MX and SRV) | | TXT | Up to 4000 printable characters, no quotes needed | TTL is how long other servers remember a record. A lower value means changes spread faster, but servers have to ask more often. ### Undo and restore - Right after **Apply** an **Undo** button appears with a 60-second countdown. It reverts the last change. - After that, use the **Revisions** list: each older revision has a **Restore this one** button. We keep the last 50 revisions. - After a change the cabinet checks that the site opens, the certificate is valid and mail finds the server. If things got worse, it offers **Roll back the change**. Records can be changed by a role with DNS rights: owner, administrator or technician. ## If it didn't work - **"The zone is ready, but the domain still points to other name servers".** The domain is not on `ns1`–`ns3`. Click **Move the domain to ZRAZU servers** (or set these servers at your registrar). - **"The zone is suspended".** ZRAZU servers are not serving it right now. Contact support. - **"Still publishing revision".** It usually takes a minute. We retry on our own; nothing to do. - **"No changes".** The draft matches what is already saved. - **"The zone was just changed in another window".** Refresh the page and try again. - **"Only the last change can be undone within a minute".** Restore an older version from **Revisions**. - **"TTL — from 60 seconds to a day"** or **"Priority is a whole number from 0 to 65535".** Fix the value in the row. --- # DNS records for a site and mail — examples URL: https://zrazu.com/en/docs/dns-records/ Add these records in the zone editor on your domain's **DNS** tab. How to turn the zone on and use the editor is described in [the DNS zone on ZRAZU servers](https://zrazu.com/en/docs/dns-zone.md). The examples below use example.com: put your own domain in, and take addresses and server names from your hosting provider or mail service. How to read the examples: the **Name** `@` means the domain itself, `www` means `www.example.com`. ## Website The address of the server where the site lives comes from your hosting. ```text Name Type Value @ A 203.0.113.10 www CNAME example.com ``` - **A** points a name to an IPv4 address. - **AAAA** does the same for IPv6. If your hosting did not give an IPv6 address, you do not need this record. - **CNAME** is an alias: a name points to another name (for example `www` to a site builder). Do not put CNAME on `@` or next to other records of the same name. For GitHub Pages and Vercel the editor has ready templates under **Quick setup → Website**. If you turn on [domain forwarding](https://zrazu.com/en/docs/dns-forward.md), it replaces your A, AAAA and CNAME records for `@` and `www`. ## Mail ### MX: where mail is delivered ```text Name Type Priority Value @ MX 10 mx1.example.com @ MX 20 mx2.example.com ``` A lower priority wins: mail goes to the server with 10 first, and to the one with 20 if it is unavailable. Your mail service gives the exact server names. For Google Workspace and Microsoft 365 there are templates under **Quick setup → Mail**. ### SPF: who may send on your behalf SPF is a TXT record on `@`. It lists the services allowed to send mail from your domain: ```text Name Type Value @ TXT v=spf1 include:_spf.google.com ~all ``` Keep only one SPF record on a domain and combine all services in it. The part after `include:` comes from your mail service. ### DKIM: signing messages The mail service gives you a record name (like `selector._domainkey`) and a long key. Add them as TXT, copying the key in full: ```text Name Type Value selector._domainkey TXT v=DKIM1; k=rsa; p=...your_key... ``` Do not put quotes around the value: they are not needed and not accepted. ### DMARC: what to do with forged messages ```text Name Type Value _dmarc TXT v=DMARC1; p=none; rua=mailto:dmarc@example.com ``` `p=none` means "just observe": nothing is blocked, and you receive reports. This is the record the **DMARC: monitor only** template adds. Turn on stricter rules once you are sure your legitimate mail passes the checks. ## Other useful records - **CAA** limits which certificate authorities may issue SSL for the domain. Example value: `0 issue "letsencrypt.org"`. Without CAA, any may. - **TXT** is also used to confirm domain ownership for Google, Meta and other services. - **SRV** describes a service: the value looks like "weight port server", for example `5 5060 sip.example.com`, with a name like `_service._protocol`. - **NS** hands a subdomain to other name servers. Not needed for the domain itself (`@`). ## If it didn't work - **"A: an IPv4 address is needed".** The A record got something that is not an IPv4 address (for example a site name). Use CNAME for a name. - **"TXT: quotes inside the value are not supported".** Remove quotes and backslashes. - **"CAA: flag, tag issue/issuewild/iodef and value".** Use the form `0 issue "letsencrypt.org"`. - **"SRV: weight port target".** Check that the value has three parts. - **The name is outside the zone.** A record name must belong to your domain. - **Mail stops or the site does not open after a change.** The editor checks this itself and offers **Roll back the change**. Also wait for the TTL: old values are still cached. --- # A domain at another registrar, and Cloudflare URL: https://zrazu.com/en/docs/dns-external/ ZRAZU DNS can also serve a domain registered elsewhere. And if you use Cloudflare, ZRAZU can set up a new domain right in your Cloudflare account. ## ZRAZU DNS for a domain at another registrar The domain stays with its current registrar, and ZRAZU runs the DNS zone. Setting our name servers at the registrar also proves that the domain is yours. 1. In the cabinet menu open **DNS → Add a domain from another registrar** ([open](https://vse.zrazu.com/dns/add/)). 2. Enter the domain without subdomains: `example.com`, not `www.example.com`. You can add up to 100 domains at once, one per line. 3. Click **Add the domain**. A request and three name servers appear. 4. At **1. Check the records we'll carry over** review the records we took from the current DNS: root, `www`, mail and common subdomains. Add rare subdomains yourself. Do not change the name servers yet. 5. At **2. Replace the name servers at the registrar** set these at your registrar: ```text ns1.zrazu.net ns2.zrazu.net ns3.zrazu.net ``` 6. We notice the change ourselves, usually a few minutes after the registry publishes it (a registry update can take up to an hour). The **Check** button speeds it up. A check takes from 20 seconds to 3 minutes. 7. Once the domain is confirmed, you edit records the same way as in [the DNS zone on ZRAZU servers](https://zrazu.com/en/docs/dns-zone.md). A request is valid for a limited time: the cabinet shows the date ("The request is valid until…"). If you miss it, the request is removed and you can create it again. The number of such domains is limited; the cabinet shows "Domains at other registrars: N of M". The limit grows after the first payment for any service or once the organization has a domain with ZRAZU. You can remove a zone with **Remove the zone**: our servers then stop serving its records. If you do not want expiry reminders, click **Stop expiry reminders**. ## Your own name servers for new domains For a ZRAZU domain you can set other name servers: on the domain's **DNS** tab click **Change name servers** and enter from 2 to 13 servers, one per line. A second-factor code is required. The new set goes to the registry, and the internet sees it within a day. For new domains this is also set at the organization level: **Settings → Organization**, the block **Name servers for new domains**. There are three options: **ZRAZU servers**, **Your own servers** and **Cloudflare (your account)**. Existing domains are changed in the domain card. ## Cloudflare If your domains are in Cloudflare, ZRAZU creates a zone in your account and switches the name servers to the ones Cloudflare issued. This needs an API key. ### How to add a key 1. In Cloudflare open **My Profile → API Tokens → Create Token → Custom token**. Global API Key and Origin CA Key do not work: they open the whole account. 2. Grant only what is needed. For reading zones: **Zone → Zone → Read**. For an edit key: **Zone → Zone → Read**, **Zone → Zone → Edit** and **Zone → DNS → Edit**. Do not grant anything else (account members, Workers, storage): we reject a key that is wider than needed. 3. In **Client IP Address Filtering** allow the ZRAZU addresses. They are shown in the cabinet on the keys page. 4. Set **TTL**, the token's expiry date. When it passes we will write to you, and the key has to be added again. 5. In the cabinet open **Team → Cloudflare keys** ([open](https://vse.zrazu.com/team/cloudflare/)), choose the purpose: **Reading zones** or **Zones and records**, paste the token into the **Cloudflare API Token** field and click **Add the key**. A token is a secret. Paste it only into this cabinet field; do not send or publish it anywhere. We never show the key, not even partly. Keys can be added and removed by the organization owner and administrator. For a few seconds we check the key with Cloudflare. Key states: "Active", "Not accepted", "Refused by Cloudflare", "Revoked". A new key of the same purpose replaces the previous one. The **Call log** shows when we used the key with Cloudflare (without values). ### What the edit key does The **Zones and records** key lets us create a zone for a domain registered with ZRAZU and the `_acme-challenge` record for SSL. We do not touch other records and do not delete zones. ### New domains straight into Cloudflare 1. Add an edit key (see above). 2. Open **Settings → Organization**, the block **Name servers for new domains**, and choose **Cloudflare (your account)**. 3. We register a new domain on ZRAZU servers, then create a zone in your Cloudflare and switch the NS to the ones Cloudflare issued. If Cloudflare refuses, the domain stays on ZRAZU servers. You can follow progress on **Team → Cloudflare keys**, in the block "Domains moving to Cloudflare". States: "Creating the zone in your Cloudflare", "Switching name servers", "Waiting for Cloudflare to see the new NS", "The domain is in Cloudflare". If Cloudflare issued an unusual pair of servers, the cabinet asks you to **Confirm** the replacement or **Decline**. A failed attempt can be **Retried**. ## If it didn't work - **The status "Awaiting NS change" does not change.** Check that all three ZRAZU servers are set at the registrar with no old ones left, and click **Check**. - **"Enter a domain, for example example.com".** Enter only the domain itself, without `www` and without `https://`. - **"The zone is suspended because the domain doesn't point to ZRAZU servers".** Set `ns1`–`ns3` back at the registrar. - **A Cloudflare key is "Not accepted".** Reasons the cabinet gives: it is a Global API Key (an API Token is needed), it is an Origin CA Key, the token cannot read zones, the token is wider than needed, it is disabled or expired, or it was not copied in full. - **The domain stayed on ZRAZU servers.** Cloudflare refused: see the reason in the domain's row and click **Retry**. --- # DNSSEC for a domain on ZRAZU servers URL: https://zrazu.com/en/docs/dns-dnssec/ DNSSEC adds a digital signature to the zone. Thanks to it, nobody can quietly forge your DNS answers. It is optional, but useful. DNSSEC is available when the domain uses our name servers `ns1.zrazu.net`, `ns2.zrazu.net` and `ns3.zrazu.net`. First [turn on the DNS zone and move the domain to ZRAZU servers](https://zrazu.com/en/docs/dns-zone.md). ## How to turn it on 1. In the [cabinet](https://vse.zrazu.com/domains/) open the domain and its **DNS** tab. 2. In the **DNSSEC** block turn on the **DNSSEC zone signing** switch. 3. Wait for the steps. The cabinet shows them in words: "Signing the zone, waiting for all name servers", then "Adding the DS to the registry", and finally "DNSSEC is working". For domains registered with ZRAZU we enter the DS record in the registry ourselves. For a domain at another registrar the cabinet asks: "Enter the DS at the domain's registrar". In that case: 1. In the DNSSEC block copy the **DS record** (Key tag, Algorithm, Digest type, Digest) or use **As one line**. Some registrars ask for the **DNSKEY** instead: Flags, Protocol, Algorithm and Public key. 2. Enter them in your registrar's panel, in its DNSSEC section. 3. Wait for the state "DNSSEC is working". DS and DNSKEY are public data. It is safe to copy them. ## How to turn it off 1. Turn the **DNSSEC zone signing** switch off and confirm with **Yes, turn DNSSEC off**. 2. First we remove the DS from the registry, and only later the zone signature. There is no rush: while the old DS lives in caches, the signature has to stay, so the domain keeps opening. At the moment this is no less than two days. 3. While DNSSEC is on or being removed, you cannot switch to foreign name servers. Turn DNSSEC off first. You can turn it on again once the signature is removed. ## A foreign DS in the registry If another provider used to sign the domain, its DS may remain in the registry. Before moving to ZRAZU servers remove it with **Remove the DS in the registry** and confirm with **Yes, remove the DS**. Do this only if the domain is no longer signed on the old name servers: otherwise it may stop opening. DNSSEC can be changed by a role with DNS rights: owner, administrator or technician. ## If it didn't work - **"Move the domain to ZRAZU name servers first".** DNSSEC works only with our servers. - **"A step is delayed, we are already looking".** Nothing to do, we will see it ourselves. - **"DNSSEC is still being turned off".** Wait until the signature is removed, then turn it on again. - **"A change of name servers is planned for the domain".** DNSSEC can be turned on once the change is applied or cancelled. - **The domain does not open after entering the DS at the registrar.** Check that the DS was copied in full and matches the zone's current key. --- # Forward a domain to another address URL: https://zrazu.com/en/docs/dns-forward/ Forwarding (a redirect) sends visitors of a domain to another address. For example, `example.com` and `www.example.com` lead to your site on a builder or to your main domain. It works for domains on ZRAZU name servers. If the domain is not there yet, forwarding starts once it moves: see [the DNS zone on ZRAZU servers](https://zrazu.com/en/docs/dns-zone.md). ## What to know Turning it on **replaces your A, AAAA and CNAME records for `@` and `www`** with ZRAZU server records. A site on the domain root stops opening and is replaced by the redirect. The cabinet warns you before you click, and after turning it on it shows which of your records were removed. Other records (for example mail) are not changed. ## How to set it up 1. In the [cabinet](https://vse.zrazu.com/domains/) open the domain and its **DNS** tab. 2. In the **Redirect** block click **Set up a redirect**. 3. In **Redirect to** enter the full address starting with `http://` or `https://`, for example `https://shop.example.com/`. 4. Choose the **Redirect type**: **Permanent (301)** for a final move or **Temporary (302)**. 5. If needed, tick **Keep the path and parameters**: then `example.com/page?x=1` opens the matching page on the new address, not its home page. 6. Click **Turn on redirect**. The cabinet says "Redirect saved". Current settings are shown in the "Now" line. You can change them with **Change** and **Save**. We issue the certificate for forwarded addresses automatically, so `https://example.com` works too. ## How to turn it off Click **Turn off** and confirm with **Yes, turn off**. A ZRAZU placeholder page stays on `@` and `www` until you add your own records. Previous records are not restored, so add them again in [the editor](https://zrazu.com/en/docs/dns-zone.md). Examples for a site are in [typical records](https://zrazu.com/en/docs/dns-records.md). Forwarding can be changed by a role with DNS rights: owner, administrator or technician. ## If it didn't work - **"The address must start with http:// or https://".** Enter the full address. - **"Enter an address with a site name, not an IP".** Forwarding to an IP address is not supported. - **"An address with a login or password is not suitable".** Remove the login and password from the address. - **"An address with # is not suitable".** Remove the part after `#`. - **"A domain cannot forward to itself".** Enter a different address. - **"The address is too long or has spaces or control characters".** Shorten it and remove spaces. - **"The domain is not on ZRAZU name servers yet".** Forwarding starts once the domain moves to `ns1`–`ns3`. - **"The redirect is being changed right now".** Refresh the page and try again. --- # SSL certificate types at ZRAZU URL: https://zrazu.com/en/docs/ssl-overview/ An SSL certificate turns on https for your site: data between the visitor and the site is encrypted, and the browser sees that the domain really is yours. ZRAZU offers a free Let’s Encrypt certificate and paid certificates with a subscription. ## Which type you need | Type | What it contains | Who it is for | | --- | --- | --- | | DV | Proof that the domain is yours | Most sites that need an invoice, contract and act, or the guarantee of the certificate authority | | Wildcard | One certificate for the domain and all its first-level subdomains (`*.example.com`) | Many subdomains of one site | | Multi-domain (SAN) | Several different domains in one certificate | Several separate sites that are easier to manage together | | OV | The verified name of the organization is in the certificate | When a bank, partner or tender asks for a verified organization | | EV | Extended verification of the organization | Only if a regulator or partner explicitly requires it | Encryption is the same for every type, and the same as in the free Let’s Encrypt. Paid certificates differ in the guarantee of the certificate authority, closing documents and support. The type of certificate does not affect Google rankings. EV looks no different in the browser address bar. Wildcard covers subdomains of one level (`shop.example.com`), but not `example.com` itself and not `a.b.example.com`. How many names you can add to a Multi-domain certificate depends on the certificate you choose: the order form shows the limit. Prices and the full list are on the page [https://zrazu.com/prices/](https://zrazu.com/prices/); the types are described in the section [https://zrazu.com/ssl/](https://zrazu.com/ssl/). ## Is the free one enough Let’s Encrypt is included with ZRAZU at no extra charge, is issued on its own and renews automatically, wildcard included, when the domain is on our name servers. If that is enough for you, take it: that is perfectly fine. You need a paid certificate when: - your accountants need an invoice, contract and act; - a partner, bank or tender asks for a purchased certificate; - you need the guarantee of the certificate authority or a trust seal on the payment page. ## The 1-year subscription A paid certificate is sold as a 1-year subscription. One issued certificate is valid for a limited time (currently up to 200 days, shorter later under industry rules), so the subscription runs in parts: when it is time for the next part, we reissue the certificate for the same key at no extra charge. For the new part to reach your site without your involvement, set up automatic renewal: [How automatic certificate renewal works](https://zrazu.com/en/docs/ssl-auto.md). If you use certbot, acme.sh, Caddy or Kubernetes, there is another way: [the ZRAZU ACME server](https://zrazu.com/en/docs/ssl-acme.md). ## What next 1. [Ordering and activating a certificate](https://zrazu.com/en/docs/ssl-order.md) 2. [Domain validation](https://zrazu.com/en/docs/ssl-dcv.md) 3. [Certificate files and installation](https://zrazu.com/en/docs/ssl-files.md) 4. [Reissue and revocation](https://zrazu.com/en/docs/ssl-reissue.md) 5. [ACME for certbot and acme.sh](https://zrazu.com/en/docs/ssl-acme.md) ## If it didn't work - **“SSL certificates are not on sale yet”.** Ordering is temporarily closed. Check later or write to support. - **No order button.** An owner, administrator or accountant of the organization can order. A role with permission to view domains can see the certificates. - **You need other names in an already issued certificate.** The set of names does not change after issuance: order a new certificate. --- # Ordering and activating a certificate URL: https://zrazu.com/en/docs/ssl-order/ An owner, administrator or accountant of the organization can order a certificate. You can pay from the balance, by card or by IBAN invoice — the same as any other order. We never receive the private key: we only need the CSR, the request for a certificate. The key stays with you. ## What a CSR is and where to get one A CSR is a text request that starts with `-----BEGIN CERTIFICATE REQUEST-----`. It is created together with the private key. There are two ways. **Create it in the cabinet.** In the order form, find the section “No CSR? Create one here”. Choose the key type: RSA (“any server”) or EC (“smaller and faster, modern servers”), then click “Create the key and CSR”. The key and the request are created in your browser and never reach us. Be sure to click “Download the private key” and keep the file: without it the certificate cannot be installed, and we cannot recover the key. **Create it on your server.** For example with openssl: ``` openssl req -new -newkey rsa:2048 -nodes -keyout kava.key -out kava.csr -subj "/CN=kava.com.ua" ``` The file `kava.key` stays with you; paste the contents of `kava.csr` into the form. CSR requirements: an RSA key of 2048 bits or more, or EC P-256 or P-384; your domain must be in the request; it may contain only domain names (no IPs, emails or links). ## How to order 1. In the cabinet open “SSL certificates” and click “Order SSL” ([cabinet](https://vse.zrazu.com/ssl/new/)). 2. Choose the payer: “LLC, with VAT” or “Sole proprietor, no VAT”. 3. Choose the certificate. The form shows the price per year at once. 4. Enter the domain, for example `kava.com.ua`. The `www.` address is included automatically. 5. For Multi-domain, add the other names, one per line. The form shows how many names are included in the price and how many more you can buy. Wildcard names (`*.domain`) are not available in every certificate. 6. Choose how to confirm the domain. Details: [Domain validation](https://zrazu.com/en/docs/ssl-dcv.md). 7. Paste the CSR or create it here. 8. Click “Go to payment” and choose how to pay: from the balance, by card or with an invoice (IBAN transfer). For an invoice, choose the payer — the company or sole proprietor it is issued to. A transfer by invoice pays the order automatically once the bank clears it. After payment you only need to confirm the domain. The certificate appears in its card, and we email you when it is issued. ## Pay now, activate later Some orders are paid first without a domain. They appear in the list with the status “Awaiting activation” and the date “Activate by …”. 1. In the certificate list click “Activate”. 2. The domain and certificate names are already paid for and cannot be changed here. Create or paste the CSR and choose the validation method. 3. Click “Activate”. The certificate year counts from activation. You do not pay again. If you change your mind, you can refuse before activation and get the amount back: to the balance or, on your request, to the card. If the activation period has passed, write to us and we will return the amount. ## Several certificates in one order If you have many domains, order up to 50 certificates together: one per domain, under one order number. Each domain needs its own CSR. The “Check CAA” button shows in advance whether the CAA record of your domain forbids issuance by our certificate authority. The whole batch is paid as one order, in any way. ## If it didn't work - **“This is a private key, not a CSR”.** You pasted the key. Never send a key to anyone; only the CSR text is needed. - **“This does not look like a CSR”.** Copy the whole text, including the BEGIN and END lines. - **“The CSR was made not for …”.** The domain in the request does not match the order domain. Create the CSR again. - **“The RSA key is shorter than 2048 bits”.** Create a longer key. - **“Too many names for this certificate”.** Remove the extra names or choose another certificate. - **Wildcard and a file on the site.** A wildcard name cannot be confirmed with a file: choose a DNS record or an email. - **“Too many orders”.** There is an hourly limit on orders. Try later. - **The authority did not accept the order.** We return the money to the balance; the reason is shown in the card. - **The domain was not confirmed within 25 days.** The order is closed and the payment is returned. --- # Domain validation for a certificate URL: https://zrazu.com/en/docs/ssl-dcv/ Before issuing a certificate, the certificate authority checks that the domain really is yours. This is called DCV. You choose the method when ordering, and you can change it later in the certificate card. For Multi-domain each name is confirmed separately, and you can choose a method for each one. ## Three methods | Method | What to do | When it fits | | --- | --- | --- | | DNS record | Add a record (TXT or CNAME) where you manage the domain DNS | The most reliable. No site needed, works for wildcard too | | File on the site | Put a small text file at the address the cabinet shows (http or https) | You have a working site and access to its files. Not for wildcard | | Email | Open the link in the email from the authority | Nothing to set up, but the domain must have mail (MX) | For email, the authority uses one of the standard addresses of the domain: `admin@`, `administrator@`, `webmaster@`, `hostmaster@` or `postmaster@`. The cabinet lets you pick a mailbox on the name itself or on the domain above it, but not on a zone such as `com.ua`. ## Confirming with a DNS record 1. Open the certificate card: [cabinet](https://vse.zrazu.com/ssl/). In the block “Validate the domain” the cabinet shows the type, name and value of the record. 2. Add this record to the domain DNS where you manage it: at ZRAZU, in Cloudflare or at another provider. 3. Click “Check now”. The authority also checks on its own, and the card updates in a minute or two. The validation data does not appear at once: the authority prepares it for a few minutes, and the page updates itself. The “Check now” button works no more than once a minute. After issuance, do not delete the record or file: with them the next parts of the subscription are issued on their own. ## Domain on ZRAZU DNS or in Cloudflare If the domain is on our name servers, the cabinet offers “Add the record automatically”. We add only the validation record to the zone and immediately ask the authority to check the domain. Other records are not changed. The same applies to a domain in your Cloudflare, if a Cloudflare key with permission to change DNS has been added under “Team → Cloudflare”. We will place only the validation record. The validation record allows a certificate to be issued for the domain, so the cabinet may ask you to confirm your sign-in again, and it emails the organization owners about the added record. ## File on the site 1. In the card, copy the file address and its content, or click “Download the file”. 2. Put the file on the site at exactly this address. It must open without a redirect. 3. Click “Check now”. ## Email 1. Open the email from the authority at the chosen domain address. 2. Follow the link in the email and confirm the domain. No email? Check spam. The card has the buttons “Send again” and “Change the mailbox or method”: an email can be sent no more than once every 2 minutes, with up to 20 changes and emails per day. ## Changing the method If the chosen method does not fit, click “Change the method” in the card, choose another and click “Apply”. We pass your choice to the authority, and the new data appears in a minute or two. ## If it didn't work - **“The domain is not confirmed yet — we will check again”.** DNS records do not update instantly. Wait and click “Check now” again. - **“The authority was just asked — try in a minute”.** This is the check limit: one request per minute. - **Cloudflare: “the zone of this domain is not in the key’s account”.** Place the record manually or add the domain to the key’s account. - **Cloudflare: the key lacks permission to change DNS.** Update the key or place the record manually. - **CAA does not allow the authority.** The domain has a CAA record that does not include our certificate authority. Add the permission in CAA or remove the restriction. In a bulk order the “Check CAA” button shows this in advance. - **The domain has no mail.** The email method needs MX. Choose DNS or a file. - **Not confirmed within 25 days.** The order is closed and the payment is returned to the balance. --- # Certificate files and server installation URL: https://zrazu.com/en/docs/ssl-files/ Once the certificate is issued, its files are available in the card. We do not have the private key, so two files go onto the server: the certificate from us and your key, created together with the CSR. ## Which files there are Open the certificate card, the “Installation” or “Certificate files” section ([cabinet](https://vse.zrazu.com/ssl/)). All roles of the organization can download the files. | File | What is in it | Where it goes | | --- | --- | --- | | fullchain.pem | Your certificate with the intermediate ones | nginx, Apache 2.4.8+, HAProxy, Caddy | | cert.pem | Your certificate only | When the chain is set separately | | chain.pem | Intermediate certificates only (CA Bundle) | When the chain is set separately | | Zip with instructions | All three files and a short note | When you want everything together | | PFX | Certificate, chain and your key in one file | IIS and Windows | All files are in PEM format, that is plain text. If a program asks for the “chain” or “CA Bundle”, that is `chain.pem`. The issue date is part of the file name, so new versions do not overwrite earlier ones. ## PFX for IIS and Windows The PFX is built right in the browser; the key is not sent anywhere. 1. In the block “PFX for IIS and Windows” pick your private key file (`.key` or `.pem`, up to 64 KB). 2. Set a PFX password of at least 8 characters and repeat it. 3. Click “Build PFX” and save the file. The modern cipher (AES-256) is read by Windows Server 2019+, IIS 10, Java and OpenSSL. Windows Server 2016 and older, and macOS Keychain, will not read it. For them build the PFX on your own computer: ``` openssl pkcs12 -export -legacy -inkey kava.key -in cert.pem -certfile chain.pem -out kava.pfx ``` ## Installing and renewing 1. Put `fullchain.pem` and your private key on the server. 2. Point your web server settings to them and restart it. 3. Check the site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) shows which certificate the site serves and until when it is valid. The card also shows whether the site serves exactly this certificate. A subscription certificate is renewed in parts. So you do not copy the new file by hand, set up automatic renewal for your hosting: [How automatic certificate renewal works](https://zrazu.com/en/docs/ssl-auto.md). If certbot or acme.sh is more convenient for you, see [ACME for certbot and acme.sh](https://zrazu.com/en/docs/ssl-acme.md). ## If it didn't work - **“The certificate is not issued yet”.** The files appear after the domain is confirmed. See [Domain validation](https://zrazu.com/en/docs/ssl-dcv.md). - **“Couldn’t get the certificate files”.** Reload the page. - **PFX: “This is not a private key in PEM”.** You need a file that starts with `-----BEGIN PRIVATE KEY-----` (or RSA/EC PRIVATE KEY). - **PFX: the key is password-protected.** Remove the password on your computer: `openssl pkey -in key.pem -out open.key`, then pick the new file. - **PFX: “This key belongs to another certificate”.** You need the key used for the CSR of this very order. - **The browser does not provide encryption (WebCrypto).** Open the cabinet in a recent Chrome, Firefox or Safari. - **The site serves the old certificate.** The new file was not picked up: restart the web server or check the automatic renewal task. --- # Reissuing and revoking a certificate URL: https://zrazu.com/en/docs/ssl-reissue/ You need a reissue when you need a new key: the key leaked, the server moved or you lost the key file. You need revocation when the certificate can no longer be trusted. Who can do what in the certificate card: all roles of the organization can download files; owners, administrators and technicians can reissue; owners and administrators can revoke. ## Scheduled renewals You do not pay for them. The 1-year subscription runs in parts, and we issue each new part ourselves. It uses the same key, so all that is needed is for your server to pick up the new certificate: [automatic renewal](https://zrazu.com/en/docs/ssl-auto.md). ## Reissue with a new CSR The term and the money stay the same, and the domain is confirmed again. The previous version stays valid until you revoke it. 1. Create a new key and CSR: on the server or in the cabinet ([Ordering and activation](https://zrazu.com/en/docs/ssl-order.md)). The CSR must be for the same domain and the same names. 2. Open the certificate card: [cabinet](https://vse.zrazu.com/ssl/). Go to the “Key and CSR” tab. 3. In the block “Reissue with a new CSR” paste the CSR and choose the domain validation method. 4. Click “Reissue”. The cabinet may ask you to confirm your sign-in again. 5. Confirm the domain ([Domain validation](https://zrazu.com/en/docs/ssl-dcv.md)). The new version appears in the “Versions” list. 6. Install the new files on the server and then, if the old key is compromised, revoke the previous version. We email the organization owners about a reissue. The set of names does not change during a reissue: if you need other names, order a new certificate. ## Revocation Revocation cannot be undone: browsers will stop trusting this version. Revoke if the key leaked or the certificate is no longer needed. 1. In the card open the “Revocation” tab. 2. Choose the version and the reason. 3. Type the domain name to confirm and click “Revoke”. If the key leaked, first reissue the certificate with a new key, install it on the server and only then revoke the old version. Otherwise the site is left without a valid certificate for a while. The owners get an email about the revocation. ## Refunds Money is fully returned only until the certificate is issued: if the authority refuses or the domain is not confirmed within 25 days, we return the amount to the balance ourselves. After issuance there is no refund. ## If it didn't work - **“Your role doesn’t allow this”.** Ask an owner or administrator of the organization. - **“The CSR was made not for …”.** The names in the new CSR must match the names of the certificate. - **“This is a private key, not a CSR”.** Paste the request text, not the key. - **The reissue failed.** The reason is in the card log (“What happened”). Try again or write to support. - **“Too many orders”.** There is an hourly limit, try later. - **No valid versions.** There is nothing to revoke: the certificate is not issued or already revoked. --- # ACME for certbot, acme.sh and Caddy URL: https://zrazu.com/en/docs/ssl-acme/ ACME is the protocol that certbot, acme.sh, lego, Caddy, Traefik and cert-manager use to issue and renew certificates on their own. ZRAZU offers two ways to use it. Both are set up in the cabinet: “SSL certificates” → “ACME for certbot” ([cabinet](https://vse.zrazu.com/ssl/acme/)). The owner, administrators and technicians can create entries. | What you need | Which way | | --- | --- | | A paid certificate from a ZRAZU subscription that renews itself | ZRAZU ACME server | | A free Let’s Encrypt, especially wildcard | acme-dns | | Your own hosting without certbot | [Server link](https://zrazu.com/en/docs/ssl-auto.md) | In both cases the private key stays on your server. ## The ZRAZU ACME server This is our certificate server for the paid subscription. Address (Directory): `https://api.zrazu.com/acme/directory`. The client registers on it through an EAB binding. 1. In the block “Our ACME server for paid certificates” enter a binding name, for example the server name, and click “Create”. 2. Save the Directory, the `kid` and the HMAC key shown. The key is shown once and nobody can restore it. 3. In the wizard “Setup for your server” choose the program (nginx with certbot, acme.sh, Caddy, Traefik, Kubernetes cert-manager, win-acme for IIS) and the domain. The cabinet shows ready commands. 4. Register the client within 7 days, otherwise the binding expires. For certbot it looks like this: ``` certbot register --server https://api.zrazu.com/acme/directory \ --eab-kid --eab-hmac-key --agree-tos -m you@example.com ``` A binding is either personal (valid while you are in the organization and can reissue certificates) or the organization’s (for a server that outlasts team changes; created by the owner and administrators). You can disable a binding in the list: issued certificates stay. How the ACME server behaves: - It first looks for a paid active subscription whose names cover the order. A reissue within the subscription costs nothing extra. - The first issuance of a subscription must be done in the cabinet: there is nothing to reissue yet, and buying twice is not allowed. - If there is no subscription, certbot can buy a certificate from the balance, but only when you turned on “Buy new certificates from the balance” in the binding and the funds are enough. Never on credit. We write to the owners about every purchase. - The domain must be on our name servers: we place the validation record in the zone ourselves. Issuance takes up to a few minutes. - Revocation through ACME is possible only with the keyCompromise reason and a signature by the certificate’s own key. Otherwise revoke in the cabinet ([Reissuing and revoking](https://zrazu.com/en/docs/ssl-reissue.md)). We email the owners about every reissue, purchase and revocation. ## acme-dns: free certificates through DNS Suited for Let’s Encrypt through certbot, acme.sh, lego and Caddy with the standard acme-dns plugin. One record covers both the domain and `*.domain`, so this is the way for wildcard. No key to the whole zone is needed. 1. In the block “New account” enter the domain. If you wish, give allowed IP addresses or networks, separated by commas. 2. Click “Create” and save the password. It is shown once. 3. Add the CNAME `_acme-challenge.domain` pointing into the ZRAZU zone. If the domain is on our name servers or in your Cloudflare with an edit key, click “Add CNAME” (or “Set the CNAME in Cloudflare”). Otherwise add the record at your DNS provider. 4. Copy the `acmedns.json` file or the commands for your client from the cabinet and issue the certificate. The password can only set the TXT validation for its own name. It cannot change the zone, the domain or the balance. An account with no update in 30 days, or with no updates for over a year, is deleted automatically together with our CNAME. If the domain is behind Cloudflare proxy (the orange cloud), visitors see the Cloudflare certificate, and yours is needed for the site server (Full strict mode). ## If it didn't work - **ACME is switched off in this environment.** The cabinet shows this note when the feature is temporarily unavailable. Write to support. - **“wait for the first issuance”.** The subscription has not been issued yet: do the first issuance in the cabinet. - **Issuance hangs.** Check that the domain is on ZRAZU name servers. - **The purchase did not work.** Check that purchase is enabled in the binding, the balance has enough funds, and the binding’s creator has the payment permission. - **Binding “expired unused”.** The HMAC key is valid for 7 days: create a new binding. - **Wildcard will not work over HTTP.** For `*.` use DNS-01 validation and acme-dns: for acme.sh that is `--dns dns_acmedns`. - **You lost the acme-dns password.** Delete the account and create a new one. --- # How automatic certificate renewal works URL: https://zrazu.com/en/docs/ssl-auto/ A ZRAZU subscription certificate is issued in parts: each part is valid for a limited time (currently up to 200 days, and shorter later under industry rules). When the next part is due, we issue it ourselves. For the new certificate to reach your site without any action from you, your server, hosting or cloud has to fetch it on a schedule, once a day. ## What you get - **A personal certificate link.** In your account, open the certificate card, section "Installation" → "Link for the server". It always points to the current subscription certificate: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem` (the certificate with intermediates), plus `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` and `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem` separately. - **Your private key stays with you.** Later parts of the subscription are issued for the same key, so you place the key once and only the public certificate is renewed after that. The link neither gives out nor accepts a key. - **A scheduled task on your side.** A script fetches the certificate from the link once a day and installs it if it is new. The scripts are in each guide below. We never ask for your hosting passwords, cloud keys or the certificate's private key: your server installs the certificate, not us. ## Pick your case | Where your site runs | Renews by itself | Guide | | --- | --- | --- | | Your own Linux server (nginx, Apache, Caddy, HAProxy, Docker) | yes | [Linux server](https://zrazu.com/en/docs/ssl-auto-linux.md) | | Windows Server with IIS | yes | [Windows and IIS](https://zrazu.com/en/docs/ssl-auto-windows-iis.md) | | Kubernetes | yes | [Kubernetes](https://zrazu.com/en/docs/ssl-auto-kubernetes.md) | | Hosting with cPanel (Hostiq, Hostpro, Ukrnames, GoDaddy, Namecheap…) | yes | [cPanel](https://zrazu.com/en/docs/ssl-auto-cpanel.md) | | AWS: load balancer, CloudFront, API Gateway | yes | [AWS](https://zrazu.com/en/docs/ssl-auto-aws.md) | | Azure: Application Gateway, App Service, Front Door | yes | [Azure](https://zrazu.com/en/docs/ssl-auto-azure.md) | | Google Cloud: load balancer with Certificate Manager | yes | [Google Cloud](https://zrazu.com/en/docs/ssl-auto-gcp.md) | | Cloudflare in front of the site | depends on the plan | [Cloudflare](https://zrazu.com/en/docs/ssl-auto-cloudflare.md) | | Hosting with a panel that has no API: hosting.ua (adm.tools), Cityhost, Mirohost, ISPmanager, Plesk, DirectAdmin, Hostinger, Hetzner | manually, we remind you | [Hosting panels](https://zrazu.com/en/docs/ssl-auto-panels-manual.md) | | Site builder: Tilda, Wix, Shopify, Prom, Horoshop… | our certificate is not needed there | [Site builders](https://zrazu.com/en/docs/ssl-auto-site-builders.md) | Not sure what you have? Open any guide and copy the AI prompt: it will ask about your hosting and walk you through. ## How to check that it works - In the certificate card, next to the link, you can see when your server last fetched the certificate and whether it got the current one. - Site check: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) shows which certificate your site serves and until when it is valid. - We send an email after each new part. If the site still serves the old certificate a few days later, the task on your server did not run: open the task log (each guide says where it is). ## Link security - The link gives out only the public certificate, the same one your site shows every visitor. Still, do not publish it: whoever has the link can see when your server fetches it. - We show the link once and store only its fingerprint. If you lost it or exposed it, use "New link" in the card: the old one stops working immediately, and you replace the address in the script. - The link works until the subscription ends. An unknown, disabled or expired link gets the same answer: "not found" (404). --- # Linux server — nginx, Apache, Caddy, HAProxy, Docker URL: https://zrazu.com/en/docs/ssl-auto-linux/ Use this if you have SSH access to the server and root rights (a VPS, a dedicated server, your own machine in a rack). You need `curl` and `openssl`, which almost every Linux has. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - The private key the certificate was ordered with (a `key.pem` file or similar). If the CSR was created by the ZRAZU account, this is the file you saved back then. - 10 minutes. ## Step 1. Put the key on the server ```sh sudo mkdir -p /etc/ssl/zrazu/example.com sudo chmod 700 /etc/ssl/zrazu/example.com sudo nano /etc/ssl/zrazu/example.com/key.pem sudo chmod 600 /etc/ssl/zrazu/example.com/key.pem ``` In `nano`, paste the whole key text, including the `-----BEGIN … PRIVATE KEY-----` and `-----END … PRIVATE KEY-----` lines, save (Ctrl+O, Enter) and exit (Ctrl+X). The key must have no password: if yours is password-protected, remove the password with `openssl pkey -in old.key -out /etc/ssl/zrazu/example.com/key.pem`. ## Step 2. The renewal script Create the file with `sudo nano /usr/local/bin/zrazu-ssl-example.com.sh`, paste the text below and change only the `RELOAD` line for your web server: - nginx — `nginx -t && systemctl reload nginx` (this is what is set); - Apache (Debian, Ubuntu) — `apachectl configtest && systemctl reload apache2`; Apache (CentOS, Rocky, Alma) — `apachectl configtest && systemctl reload httpd`; - Caddy — `systemctl reload caddy`; - HAProxy — `systemctl reload haproxy` and `COMBINED=1` (HAProxy reads the certificate and key from one file, `combined.pem`); - nginx in Docker — `docker exec CONTAINER_NAME nginx -s reload` (mount the `/etc/ssl/zrazu` directory into the container as a volume). ```sh file=zrazu-ssl-update.sh #!/bin/sh # ZRAZU: updates the SSL certificate using the personal link. Run by cron once a day. set -eu # cron gives a short PATH without /usr/sbin, and nginx and apachectl live there. PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" DIR="/etc/ssl/zrazu/example.com" KEY="$DIR/key.pem" RELOAD="nginx -t && systemctl reload nginx" COMBINED=0 umask 077 tmp=$(mktemp "$DIR/.new.XXXXXX") trap 'rm -f "$tmp"' EXIT curl -fsS --retry 3 --max-time 60 -o "$tmp" "$PULL/fullchain.pem" grep -q "BEGIN CERTIFICATE" "$tmp" || { echo "ZRAZU: the link does not return a certificate"; exit 1; } if [ -f "$DIR/.applied" ] && cmp -s "$tmp" "$DIR/.applied"; then echo "ZRAZU: certificate unchanged" exit 0 fi cert_pub=$(openssl x509 -in "$tmp" -noout -pubkey | openssl sha256) key_pub=$(openssl pkey -in "$KEY" -pubout | openssl sha256) if [ "$cert_pub" != "$key_pub" ]; then echo "ZRAZU: certificate was issued for a different key — changing nothing, put the new key in $KEY" exit 1 fi openssl x509 -in "$tmp" -noout -checkend 0 >/dev/null || { echo "ZRAZU: certificate has already expired"; exit 1; } chmod 644 "$tmp" mv -f "$tmp" "$DIR/fullchain.pem" if [ "$COMBINED" = 1 ]; then cat "$DIR/fullchain.pem" "$KEY" > "$DIR/combined.pem.new" mv -f "$DIR/combined.pem.new" "$DIR/combined.pem" fi sh -c "$RELOAD" cp "$DIR/fullchain.pem" "$DIR/.applied" echo "ZRAZU: new certificate installed, valid until $(openssl x509 -in "$DIR/fullchain.pem" -noout -enddate | cut -d= -f2)" ``` The script changes nothing if the web server already runs this certificate, if the file at the link is not a certificate, or if the certificate does not match your key or has already expired. It checks the web server configuration before reloading, so a broken config will not take your site down; and if the reload fails, the script tries again the next day. Make the file executable and run it once by hand: ```sh sudo chmod 700 /usr/local/bin/zrazu-ssl-example.com.sh sudo /usr/local/bin/zrazu-ssl-example.com.sh ``` You should see "new certificate installed" and the file `/etc/ssl/zrazu/example.com/fullchain.pem` should appear. ## Step 3. Point the web server at the files (once) nginx — in the site's `server` block: ```nginx ssl_certificate /etc/ssl/zrazu/example.com/fullchain.pem; ssl_certificate_key /etc/ssl/zrazu/example.com/key.pem; ``` Apache 2.4.8 and newer — in ``: ```apache SSLCertificateFile /etc/ssl/zrazu/example.com/fullchain.pem SSLCertificateKeyFile /etc/ssl/zrazu/example.com/key.pem ``` Caddy — in the site block: `tls /etc/ssl/zrazu/example.com/fullchain.pem /etc/ssl/zrazu/example.com/key.pem`. HAProxy — in `bind :443 ssl crt /etc/ssl/zrazu/example.com/combined.pem`. Check the config (`nginx -t` or `apachectl configtest`) and reload the web server. ## Step 4. Schedule ```sh echo "17 4 * * * root /usr/local/bin/zrazu-ssl-example.com.sh >> /var/log/zrazu-ssl.log 2>&1" | sudo tee /etc/cron.d/zrazu-ssl-example.com ``` The script will run every day at 04:17 server time. You can pick any minute — just better not exactly 00. ## Check 1. `sudo tail /var/log/zrazu-ssl.log` — tomorrow it will show "certificate unchanged": the schedule works. 2. The site serves our certificate: `echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -enddate` or the page [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). 3. In your account, the certificate card shows that the server fetched the current certificate. ## If it did not work - `curl: (22) … 404` — the link is disabled or replaced. Create a new one in the certificate card and replace the `PULL` line in the script. - `curl: (22) … 429` — too many requests (over 60 per hour). Once a day is well within the limit. - "certificate was issued for a different key" — the certificate was reissued with a new key. Put the new key in `key.pem` and run the script again. - `nginx: [emerg]` after the reload — an error in the site configuration, not in the certificate; the old certificate stays in use until you fix the error. --- # Windows Server and IIS URL: https://zrazu.com/en/docs/ssl-auto-windows-iis/ Use this for a site on IIS (Windows Server 2016 and newer) if the certificate is already installed on the server, meaning the private key is in the Windows certificate store. This is the case when the CSR was created in IIS ("Create Certificate Request") or a PFX was imported at some point. How it works: a PowerShell script fetches the new certificate from the link, puts it into the computer store and links it to the key already there (`certutil -repairstore`). If the server has no key for the new certificate, the script changes nothing. Then it binds the new certificate to all of the site's HTTPS bindings in IIS. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - Sign-in to the server with administrator rights. - The site name in IIS (as in **IIS Manager → Sites**), for example `Default Web Site`. ## Step 1. First installation (if the certificate is not installed yet) If the CSR was created in IIS: **IIS Manager → server → Server Certificates → Complete Certificate Request** → the `cert.pem` file from `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem`. If you have the key as a file, build a PFX in your account (certificate card → "Files" → PFX) and import it: **Server Certificates → Import**. Then **Sites → site → Bindings → https → SSL certificate**. ## Step 2. The script Open **PowerShell as administrator** and create the file: ```powershell New-Item -ItemType Directory -Force -Path "$env:ProgramFiles\ZRAZU" | Out-Null notepad "$env:ProgramFiles\ZRAZU\zrazu-ssl.ps1" ``` Paste the text below into Notepad, put your IIS site name in the `$Site` line, and save. ```powershell file=zrazu-iis-update.ps1 # ZRAZU: updates the SSL certificate in IIS using the personal link. Run by Task Scheduler once a day. $ErrorActionPreference = "Stop" $Url = "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" $Site = "Default Web Site" $Dir = Join-Path $env:ProgramFiles "ZRAZU" $CertFile = Join-Path $Dir "cert.cer" $ChainFile = Join-Path $Dir "chain.cer" Invoke-WebRequest -Uri "$Url/cert.pem" -OutFile $CertFile -UseBasicParsing Invoke-WebRequest -Uri "$Url/chain.pem" -OutFile $ChainFile -UseBasicParsing $New = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertFile) # Already imported — do not import again, but check the binding: yesterday the import may have worked and the binding not. $Have = Test-Path "Cert:\LocalMachine\My\$($New.Thumbprint)" if (-not $Have) { Import-Certificate -FilePath $ChainFile -CertStoreLocation Cert:\LocalMachine\CA | Out-Null Import-Certificate -FilePath $CertFile -CertStoreLocation Cert:\LocalMachine\My | Out-Null certutil -repairstore my $New.Thumbprint | Out-Null } $Mine = Get-Item "Cert:\LocalMachine\My\$($New.Thumbprint)" if (-not $Mine.HasPrivateKey) { if (-not $Have) { Remove-Item $Mine.PSPath } throw "ZRAZU: this server has no key for this certificate — certificate not replaced" } Import-Module WebAdministration foreach ($Binding in Get-WebBinding -Name $Site -Protocol https) { if ($Binding.certificateHash -ne $New.Thumbprint) { $Binding.AddSslCertificate($New.Thumbprint, "My") } } $Until = $New.NotAfter.ToString('yyyy-MM-dd') if ($Have) { "ZRAZU: certificate unchanged, valid until $Until" } else { "ZRAZU: new certificate installed, valid until $Until" } ``` Run it once by hand: ```powershell powershell -NoProfile -ExecutionPolicy Bypass -File "$env:ProgramFiles\ZRAZU\zrazu-ssl.ps1" ``` ## Step 3. Schedule ```powershell schtasks /Create /F /SC DAILY /ST 04:17 /RU SYSTEM /TN "ZRAZU SSL" /TR "powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Program Files\ZRAZU\zrazu-ssl.ps1\"" ``` The task will appear in **Task Scheduler → Task Scheduler Library → ZRAZU SSL** and will run every day at 04:17 as the system. ## Check 1. A manual run prints "new certificate installed" or "certificate unchanged". 2. **IIS Manager → Sites → site → Bindings → https** — the certificate with the new date is selected. 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). 4. The result of the daily runs: **Task Scheduler → ZRAZU SSL → History** (the **Last Run Result** column: `0x0` means success). ## If it did not work - "this server has no key for this certificate" — the certificate was issued for a key that this server does not have (reissued with a new key, or the CSR was created elsewhere). Import a PFX with the new key (step 1). - `running scripts is disabled` — run it exactly as in steps 2–3: with `-ExecutionPolicy Bypass`. - `(404) Not Found` — the link is disabled or replaced: create a new one in the certificate card and replace `$Url`. - A site on IIS 8 / Windows Server 2012 — update the server: this Windows version no longer receives security updates. --- # Kubernetes — the certificate in a TLS secret renews by itself URL: https://zrazu.com/en/docs/ssl-auto-kubernetes/ Use this if your site runs in Kubernetes behind an ingress (ingress-nginx, Traefik, HAProxy Ingress and so on) and the certificate is stored in a secret of type `kubernetes.io/tls`. Ingress controllers watch secrets themselves: once you update the secret, the site serves the new certificate within a minute or two. How it works: a CronJob fetches the certificate from the link once a day, compares it with the one in the secret, checks that it matches the key from that same secret, and replaces only `tls.crt`. The key is never copied anywhere. The job's permissions are to read and change one secret in one namespace. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - `kubectl` with access to your site's namespace. - Outbound internet access from the cluster (to `api.zrazu.com` and to the Alpine Linux mirrors — the image installs `curl`, `openssl` and `jq` on every run). ## Step 1. The TLS secret (if it does not exist yet) Download `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem` into a file named `fullchain.pem` and create the secret with your key: ```sh curl -fsS -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem" kubectl -n NAMESPACE_NAME create secret tls zrazu-tls --cert=fullchain.pem --key=key.pem ``` In your site's Ingress, specify this secret: `spec.tls[].secretName: zrazu-tls`. ## Step 2. The CronJob Save the text below to a file named `zrazu-ssl.yaml`. If your secret has a different name, replace `zrazu-tls` (it appears twice). ```yaml file=zrazu-ssl-k8s.yaml # ZRAZU: updates the certificate in a TLS secret using the personal link. Runs once a day. apiVersion: v1 kind: ServiceAccount metadata: name: zrazu-ssl --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: zrazu-ssl rules: - apiGroups: [""] resources: ["secrets"] resourceNames: ["zrazu-tls"] verbs: ["get", "patch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: zrazu-ssl roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: zrazu-ssl subjects: - kind: ServiceAccount name: zrazu-ssl --- apiVersion: batch/v1 kind: CronJob metadata: name: zrazu-ssl spec: schedule: "17 4 * * *" concurrencyPolicy: Forbid jobTemplate: spec: backoffLimit: 2 template: spec: serviceAccountName: zrazu-ssl restartPolicy: Never containers: - name: update image: alpine:3.20 env: - name: PULL value: "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" - name: SECRET value: "zrazu-tls" command: ["/bin/sh", "-c"] args: - | set -eu apk add --no-cache curl openssl jq >/dev/null SA=/var/run/secrets/kubernetes.io/serviceaccount API="https://kubernetes.default.svc/api/v1/namespaces/$(cat $SA/namespace)/secrets/$SECRET" k() { curl -fsS --cacert "$SA/ca.crt" -H "Authorization: Bearer $(cat $SA/token)" "$@"; } cd /tmp curl -fsS --retry 3 --max-time 60 -o new.pem "$PULL/fullchain.pem" grep -q "BEGIN CERTIFICATE" new.pem || { echo "ZRAZU: not a certificate"; exit 1; } k "$API" > secret.json jq -r '.data["tls.crt"]' secret.json | base64 -d > current.pem if cmp -s new.pem current.pem; then echo "ZRAZU: unchanged"; exit 0; fi jq -r '.data["tls.key"]' secret.json | base64 -d > key.pem cert_pub=$(openssl x509 -in new.pem -noout -pubkey | openssl sha256) key_pub=$(openssl pkey -in key.pem -pubout | openssl sha256) rm -f key.pem [ "$cert_pub" = "$key_pub" ] || { echo "ZRAZU: certificate is for another key"; exit 1; } openssl x509 -in new.pem -noout -checkend 0 >/dev/null || { echo "ZRAZU: expired"; exit 1; } crt=$(base64 < new.pem | tr -d '\n') k -X PATCH -H "Content-Type: application/merge-patch+json" --data "{\"data\":{\"tls.crt\":\"$crt\"}}" "$API" >/dev/null echo "ZRAZU: updated, valid until $(openssl x509 -in new.pem -noout -enddate | cut -d= -f2)" ``` Apply it in your site's namespace: ```sh kubectl -n NAMESPACE_NAME apply -f zrazu-ssl.yaml ``` ## Check 1. Run the job once by hand: `kubectl -n NAMESPACE_NAME create job --from=cronjob/zrazu-ssl zrazu-ssl-test`. 2. Log: `kubectl -n NAMESPACE_NAME logs job/zrazu-ssl-test` — "updated" or "unchanged". 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). 4. Remove the test job: `kubectl -n NAMESPACE_NAME delete job zrazu-ssl-test`. ## If it did not work - `403` in the log — the Role is for the wrong secret or the wrong namespace: the name in `resourceNames` must match the secret's name. - `apk: … network error` — the cluster has no internet access to the Alpine mirrors. Build your own image with `curl`, `openssl` and `jq` and remove the `apk add` line. - "certificate is for another key" — the certificate was reissued with a new key: recreate the secret (step 1) with the new key. - The secret is managed by cert-manager — then you do not need this guide: cert-manager renews the certificate by itself through the ZRAZU ACME server (in your account, "Installation" → ACME). --- # Hosting with cPanel — the certificate renews by itself URL: https://zrazu.com/en/docs/ssl-auto-cpanel/ Use this for hosting with a cPanel panel: Hostiq, Hostpro, Ukrnames, GoDaddy, Namecheap, some NIC.UA plans and many others. A sign of cPanel: the panel has "Files", "Security" and "Advanced" sections, and the login address often ends in `:2083`. You do not need SSH; everything is done with the mouse in the panel. Your private key is stored in cPanel itself and never gets into the script: cPanel picks the key the certificate was first installed with for the new certificate on its own. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - In cPanel, the **Cron Jobs** item in the "Advanced" section. If it is missing, your plan does not allow scheduled tasks: write to your host or switch to [manual renewal](https://zrazu.com/en/docs/ssl-auto-panels-manual.md). - 10 minutes. ## Step 1. First installation (if the certificate is not installed yet) 1. Open **Security → SSL/TLS → Manage SSL sites**. 2. In the **Domain** field choose example.com. 3. **Certificate (CRT)** — paste the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` (open the link in a browser and copy all the text). 4. **Private Key (KEY)** — your private key. If the CSR was created in this cPanel, the key fills in by itself after you paste the certificate. 5. **Certificate Authority Bundle (CABUNDLE)** — the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem`. 6. Click **Install Certificate**. After this, the key is saved in cPanel, and the certificate will be renewed without it from now on. ## Step 2. The renewal script 1. Open **Files → File Manager**. You are in your home folder (`/home/…` is selected at the top left). Do **not** go into `public_html` — the script must not be reachable from the website. 2. **+ Folder** → name `zrazu-ssl` → **Create New Folder**. Go into it. 3. **+ File** → name `update.sh` → **Create New File**. Select the file → **Edit**, paste the text below and click **Save Changes**. ```sh file=zrazu-cpanel-update.sh #!/bin/sh # ZRAZU: updates SSL in cPanel using the personal link. Run by cron once a day. set -eu PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" DOMAIN="example.com" UAPI=/usr/local/cpanel/bin/uapi cd "$HOME/zrazu-ssl" curl -fsS --retry 3 --max-time 60 -o cert.new "$PULL/cert.pem" curl -fsS --retry 3 --max-time 60 -o chain.new "$PULL/chain.pem" grep -q "BEGIN CERTIFICATE" cert.new || { echo "ZRAZU: the link does not return a certificate"; exit 1; } if [ -f cert.applied ] && cmp -s cert.new cert.applied; then echo "ZRAZU: certificate unchanged" rm -f cert.new chain.new exit 0 fi enc() { perl -0777 -pe 's/([^A-Za-z0-9_.~-])/sprintf("%%%02X", ord($1))/seg' "$1"; } out=$("$UAPI" --output=json SSL install_ssl domain="$DOMAIN" cert="$(enc cert.new)" cabundle="$(enc chain.new)") if printf '%s' "$out" | grep -Eq '"status" *: *1'; then mv -f cert.new cert.applied rm -f chain.new echo "ZRAZU: new certificate installed" else echo "ZRAZU: cPanel did not install the certificate, response:" printf '%s\n' "$out" exit 1 fi ``` 4. Select `update.sh` → **Permissions** → set `700` → **Change Permissions**. ## Step 3. Schedule 1. Open **Advanced → Cron Jobs**. 2. You can enter your own email in **Cron Email** — then every error will be emailed to you. 3. In **Add New Cron Job** → **Common Settings** choose **Once Per Minute** (this is only for the first check; we change it in step 4). 4. **Command**: ```sh /bin/sh $HOME/zrazu-ssl/update.sh >> $HOME/zrazu-ssl/log.txt 2>&1 ``` 5. **Add New Cron Job**. ## Step 4. Check 1. Wait 2 minutes and open `zrazu-ssl/log.txt` in File Manager. It should say "new certificate installed", and after that "certificate unchanged". 2. Go back to **Cron Jobs**, click **Edit** on the task in the list and change **Common Settings** to **Once Per Day**. Save. 3. Check the site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) — it should show the ZRAZU certificate and its expiry date. ## So your host does not replace our certificate Many cPanel hosts install a free certificate themselves (AutoSSL). By default it does not touch ours, but if your host allowed it, open **Security → SSL/TLS Status**, tick example.com and `www.example.com` and click **Exclude Domains from AutoSSL**. ## If it did not work - The log says `uapi: not found` or `Permission denied` — the host has closed the cPanel tool to scripts. Then create a token in **Security → Manage API Tokens** and in the script replace the `out=$(…)` line with this one (LOGIN is your cPanel login name, SERVER is the address you use to open cPanel, without `:2083`): ```sh out=$(curl -fsS -H "Authorization: cpanel LOGIN:TOKEN" "https://SERVER:2083/execute/SSL/install_ssl" --data-urlencode "domain=$DOMAIN" --data-urlencode "cert@cert.new" --data-urlencode "cabundle@chain.new") ``` - "cPanel did not install the certificate" and the response mentions the key (`private key`) — cPanel has no key for this certificate. Repeat step 1 with your key. - `curl: (22) … 404` — the link is disabled or replaced: create a new one in the certificate card and replace the `PULL` line. --- # Hosting panels without automation — renew by hand URL: https://zrazu.com/en/docs/ssl-auto-panels-manual/ These panels have no tool a script on the hosting could use to install a certificate by itself (or it is not publicly documented). So the new certificate is installed by hand: 3–5 minutes once every few months. We will email you as soon as a new part of the subscription is ready, with a link to this page. ## What to paste Open your link from the account in a browser and copy the text: - **Certificate (CRT)** — `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem`; - **Chain / CA bundle / intermediates** — `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem`; - if there is a single field for everything ("certificate with chain", "fullchain") — `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem`; - **Private key** — your key, the same as last time. Many panels remember it themselves. ## Where it is in the panel The Ukrainian panels show these menus in Ukrainian, so the menu paths are given as they appear, with an English translation in brackets. | Panel / hosting | Menu path | | --- | --- | | adm.tools (hosting.ua, ukraine.com.ua) | **Хостинг → Мої сайти → сайт → Налаштування SSL → «Ваш сертифікат»** (Hosting → My sites → site → SSL settings → "Your certificate"). Paste the certificate with the chain (`fullchain.pem`) or turn on "add intermediates". RSA keys only. Changes take effect in 15–30 minutes | | Cityhost (Hosting 2.0) | **SSL** → add your own certificate → paste the certificate and key | | Mirohost | **Сервер → SSL-сертифікати → Імпорт сертифіката** (Server → SSL certificates → Import certificate) | | ISPmanager (FreeHost, Tucha, Hostpro and others) | **SSL-сертифікати → Створити / Додати → Існуючий** (SSL certificates → Create / Add → Existing): certificate, key, chain; then in **Сайти / WWW-домени** (Sites / WWW domains) choose this certificate | | Plesk | **Сайти та домени → домен → SSL/TLS-сертифікати → Завантажити** (Websites & Domains → domain → SSL/TLS Certificates → Upload) | | DirectAdmin (NIC.UA, Tucha and others) | **Account Manager → SSL Certificates → Paste a pre-generated certificate and key**; the chain — **Click Here to paste a CA Root Certificate** | | Hostinger (hPanel) | **Websites → Manage → Security → SSL** → delete the current one → **Import SSL** | | Hetzner (konsoleH) | **Services → SSL Manager → New Certificate → Import Certificate** (key without a password, everything in PEM) | After replacing it, check the site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) — it should show a new expiry date. ## So the panel does not replace our certificate with a free one Almost all of these hosts can install a free Let's Encrypt certificate by themselves. If your site's SSL settings have "automatic Let's Encrypt" or "issue Let's Encrypt only" turned on, turn it off for the domain — otherwise the panel may replace our certificate with its own. ## How to avoid doing this by hand The validity of each certificate part gets shorter over the years (under industry rules, down to 47 days in 2029), so manual replacement will become frequent. Fully automatic options: - move to a plan or hosting with **cPanel** — [guide](https://zrazu.com/en/docs/ssl-auto-cpanel.md); - a VPS with SSH access — [Linux server](https://zrazu.com/en/docs/ssl-auto-linux.md); - if your hosting gives you SSH and cron (for example, on higher plans), the [Linux server](https://zrazu.com/en/docs/ssl-auto-linux.md) script often works there too, as long as the panel reads the certificate from a file. Ask your hosting support where the site takes its certificate from, and copy the AI prompt — it will help adapt the script. ## If it did not work - The panel says the key does not match — you pasted the wrong key. You need exactly the one the certificate was ordered with (or reissued with). - The browser complains about an incomplete chain — `chain.pem` was not pasted, or `cert.pem` was pasted where `fullchain.pem` is needed. - The key is ECDSA, but the panel accepts only RSA (adm.tools) — reissue the certificate in your account with an RSA key. --- # AWS — load balancer, CloudFront, API Gateway URL: https://zrazu.com/en/docs/ssl-auto-aws/ Use this if your site gets its certificate through AWS: Application or Network Load Balancer, CloudFront, API Gateway, Elastic Beanstalk. The certificate lives in AWS Certificate Manager (ACM). We never ask for keys to your AWS: the function runs in your account and is allowed to update only one certificate. How it works: ACM lets you import a new certificate under the same ARN, and every service that uses it switches to the new one without reconfiguration. A Lambda function compares the certificate at the link with the one in ACM once a day and, if it is new, imports it together with your key stored in Secrets Manager. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - A private key without a password (RSA 2048 or ECDSA P-256), the one the certificate was ordered with. - Access to the AWS Console with permission to create Lambda functions, secrets and IAM roles. - 20 minutes. **Region.** For CloudFront the certificate must be in the **US East (N. Virginia) us-east-1** region, so create both the secret and the function there. For a load balancer, use the load balancer's region. ## Step 1. Put the key in Secrets Manager 1. **Secrets Manager → Store a new secret**. 2. **Other type of secret** → **Plaintext** tab → delete the example and paste the whole key text, including the `-----BEGIN … PRIVATE KEY-----` and `-----END … PRIVATE KEY-----` lines. 3. **Next** → name it `zrazu-ssl-key` → **Next** → **Next** → **Store**. 4. Open the secret and copy the **Secret ARN**. ## Step 2. First import into ACM (if the certificate is not there yet) 1. **Certificate Manager → Import a certificate**. 2. **Certificate body** — the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` (open it in a browser and copy all the text); **Certificate private key** — your key; **Certificate chain** — the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem`. 3. **Import**. Open the certificate and copy its **ARN**. 4. Attach the certificate to the service if you have not yet: for a load balancer, **Listeners → HTTPS:443 → Edit → Default SSL/TLS certificate**; for CloudFront, **Distribution → Edit → Custom SSL certificate**. ## Step 3. The Lambda function 1. **Lambda → Create function → Author from scratch**. Name it `zrazu-ssl-update`, set **Runtime** to Node.js 22.x, then **Create function**. 2. On the **Code** tab open `index.mjs` and replace all the text with the code below. Put your values in the `CERT_ARN` (from step 2) and `KEY_SECRET` (from step 1) lines. Click **Deploy**. ```js file=zrazu-aws-lambda.mjs // ZRAZU: updates the certificate in AWS Certificate Manager using the personal link. Runs once a day. import { ACMClient, DescribeCertificateCommand, ImportCertificateCommand } from "@aws-sdk/client-acm"; import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager"; import { X509Certificate, createPrivateKey } from "node:crypto"; const PULL = "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN"; const CERT_ARN = "arn:aws:acm:REGION:ACCOUNT:certificate/…"; const KEY_SECRET = "arn:aws:secretsmanager:REGION:ACCOUNT:secret:zrazu-ssl-key-…"; async function pem(part) { const res = await fetch(`${PULL}/${part}.pem`); if (!res.ok) throw new Error(`ZRAZU: ${part}.pem — HTTP ${res.status}`); const text = await res.text(); if (!text.includes("BEGIN CERTIFICATE")) throw new Error("ZRAZU: the link does not return a certificate"); return text; } const serial = (s) => (s ?? "").replace(/:/g, "").replace(/^0+/, "").toUpperCase(); export const handler = async () => { const acm = new ACMClient({ region: CERT_ARN.split(":")[3] }); const [cert, chain] = await Promise.all([pem("cert"), pem("chain")]); const leaf = new X509Certificate(cert); const current = await acm.send(new DescribeCertificateCommand({ CertificateArn: CERT_ARN })); if (serial(current.Certificate?.Serial) === serial(leaf.serialNumber)) return "ZRAZU: certificate unchanged"; if (new Date(leaf.validTo) <= new Date()) throw new Error("ZRAZU: certificate has already expired"); const secrets = new SecretsManagerClient({ region: KEY_SECRET.split(":")[3] }); const { SecretString: key } = await secrets.send(new GetSecretValueCommand({ SecretId: KEY_SECRET })); if (!leaf.checkPrivateKey(createPrivateKey(key))) { throw new Error("ZRAZU: certificate was issued for a different key — put the new key in the secret"); } await acm.send(new ImportCertificateCommand({ CertificateArn: CERT_ARN, Certificate: Buffer.from(cert), CertificateChain: Buffer.from(chain), PrivateKey: Buffer.from(key), })); return `ZRAZU: new certificate installed, valid until ${leaf.validTo}`; }; ``` 3. **Configuration → General configuration → Edit** → set **Timeout** to 30 seconds → **Save**. ## Step 4. Function permissions — only for this certificate and this secret 1. **Configuration → Permissions** → click the role name (IAM opens). 2. **Add permissions → Create inline policy** → **JSON** tab → paste the text below, putting in your two ARNs. 3. **Next** → name it `zrazu-ssl-update` → **Create policy**. ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["acm:DescribeCertificate", "acm:ImportCertificate"], "Resource": "CERTIFICATE_ARN" }, { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "SECRET_ARN" } ] } ``` ## Step 5. Schedule 1. In the function, **Add trigger** → **EventBridge (CloudWatch Events)**. 2. **Create a new rule** → name `zrazu-ssl-daily` → **Schedule expression** → `rate(1 day)` → **Add**. ## Check 1. In the function, open the **Test** tab → **Test** (any event). The result is "new certificate installed" or "certificate unchanged". 2. In **Certificate Manager**, the certificate shows a new **Expires** date. 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). CloudFront takes a few minutes to spread the new certificate to its nodes. 4. The log of each run: **Monitor → View CloudWatch logs**. ## If it did not work - `AccessDeniedException` — the policy from step 4 has the wrong ARN or the wrong region. - `HTTP 404` — the link is disabled or replaced: create a new one in the certificate card and replace the `PULL` line. - "certificate was issued for a different key" — the certificate was reissued with a new key: update the secret (**Retrieve secret value → Edit**). - `ValidationException` about the key — the key has a password or is in the wrong format: you need a PEM without a password. - Task timed out — increase **Timeout** (step 3). --- # Azure — Application Gateway, App Service, Front Door URL: https://zrazu.com/en/docs/ssl-auto-azure/ Use this if your site's certificate is stored in **Azure Key Vault** and used by Application Gateway v2, App Service or Front Door (Standard/Premium). These services switch to a new certificate version in Key Vault by themselves if they are linked "without a version" (Latest): Application Gateway within 4 hours, App Service within a day, Front Door within up to 72 hours. How it works: a runbook in Azure Automation fetches the certificate from the link once a day, compares it with the current one in Key Vault and, if it is new, builds a PFX with your key (the key is stored in the same Key Vault as a secret) and imports a new version. We get no access to your Azure. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - A private key without a password, the `key.pem` file. For Front Door, RSA only: Front Door does not accept ECDSA keys. - A Key Vault with the **Azure role-based access control** permission model and Owner rights on it. ## Step 1. Certificate and key in Key Vault Open **Cloud Shell** (the `>_` button at the top of the portal, Bash mode), upload `key.pem` (**Manage files → Upload**) and run the commands below, putting in the name of your Key Vault: ```sh VAULT=KEY_VAULT_NAME curl -fsS -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem" az keyvault secret set --vault-name $VAULT --name zrazu-ssl-key --file key.pem openssl pkcs12 -export -in fullchain.pem -inkey key.pem -out zrazu.pfx -passout pass: az keyvault certificate import --vault-name $VAULT --name zrazu-ssl --file zrazu.pfx rm key.pem zrazu.pfx ``` If the certificate is already in Key Vault under another name, skip the last import and change `$CertName` in the runbook (step 3). Link the certificate to the service without a version if you have not yet: Application Gateway — **Listeners → certificate from Key Vault**; App Service — **Certificates → Bring your own certificates → Import from Key Vault**; Front Door — **Secrets → Add certificate → Latest version**. ## Step 2. Automation account 1. **Automation Accounts → Create** → same resource group and region as the Key Vault → **Review + Create**. 2. In the account, **Account Settings → Identity** → **System assigned: On** → **Save**. 3. In the Key Vault, **Access control (IAM) → Add role assignment**: role **Key Vault Certificates Officer** → **Managed identity** → your Automation account → **Review + assign**. Repeat for the **Key Vault Secrets User** role. ## Step 3. Runbook 1. In the Automation account, **Process Automation → Runbooks → Create a runbook**: name `zrazu-ssl-update`, **Runbook type** PowerShell, **Runtime version** 7.2 → **Create**. 2. Paste the text below, put the Key Vault name in the `$Vault` line → **Save** → **Publish**. ```powershell file=zrazu-azure-runbook.ps1 # ZRAZU: updates the certificate in Azure Key Vault using the personal link. Runs once a day. $ErrorActionPreference = "Stop" $Pull = "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" $Vault = "KEY_VAULT_NAME" $CertName = "zrazu-ssl" $KeySecret = "zrazu-ssl-key" $X509 = [Security.Cryptography.X509Certificates.X509Certificate2] Connect-AzAccount -Identity | Out-Null $full = (Invoke-WebRequest -Uri "$Pull/fullchain.pem" -UseBasicParsing).Content if ($full -is [byte[]]) { $full = [Text.Encoding]::ASCII.GetString($full) } $pems = @([regex]::Matches($full, "-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----") | ForEach-Object { $_.Value }) if ($pems.Count -eq 0) { throw "ZRAZU: not a certificate" } $leaf = $X509::CreateFromPem($pems[0]) $current = Get-AzKeyVaultCertificate -VaultName $Vault -Name $CertName if ($current -and $current.Thumbprint -eq $leaf.Thumbprint) { "ZRAZU: unchanged"; return } if ($leaf.NotAfter -le (Get-Date)) { throw "ZRAZU: certificate expired" } $key = Get-AzKeyVaultSecret -VaultName $Vault -Name $KeySecret -AsPlainText $withKey = $X509::CreateFromPem($pems[0], $key) $all = New-Object Security.Cryptography.X509Certificates.X509Certificate2Collection [void]$all.Add($withKey) foreach ($pem in ($pems | Select-Object -Skip 1)) { [void]$all.Add($X509::CreateFromPem($pem)) } $pfx = $all.Export([Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12) Import-AzKeyVaultCertificate -VaultName $Vault -Name $CertName -CertificateString ([Convert]::ToBase64String($pfx)) | Out-Null "ZRAZU: updated, valid until $($leaf.NotAfter.ToString('yyyy-MM-dd'))" ``` If the key does not match the certificate, `CreateFromPem` stops with an error and nothing is imported. ## Step 4. Schedule In the runbook, **Link to schedule → Link a schedule to your runbook → Add a schedule**: name `zrazu-daily`, **Recurrence** Recurring, every 1 day, any time at night → **Create** → **OK**. ## Check 1. In the runbook, **Start** → **OK**. Open the job (**Jobs**), **Output** tab: "updated" or "unchanged". 2. In the Key Vault, **Certificates → zrazu-ssl** shows a new version with a new date. 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) — allowing for how fast your service picks up the new version (see the top of this page). ## If it did not work - `Forbidden` / `does not have secrets get permission` — one of the two roles from step 2 was not assigned, or the Key Vault uses the access policy model: then in **Access policies** give the identity Certificates: Get, Import and Secrets: Get. - "The provided key does not match" — the certificate was reissued with a new key: `az keyvault secret set --vault-name $VAULT --name zrazu-ssl-key --file new-key.pem`. - `404` — the link is disabled or replaced: create a new one in the certificate card and replace `$Pull`. - Front Door does not take the certificate — the key is ECDSA, or the certificate is linked with a specific version instead of Latest. --- # Google Cloud — load balancer with Certificate Manager URL: https://zrazu.com/en/docs/ssl-auto-gcp/ Use this for a Google Cloud external load balancer if the certificate is attached through **Certificate Manager** (a certificate map). Certificate Manager updates a certificate in place: bindings do not change. "Classic" load balancer certificates (`compute ssl-certificates`) cannot be updated in place — move the certificate to Certificate Manager. Everything is done with commands in **Cloud Shell** (the `>_` button at the top of the Google Cloud console) — you do not need to install anything on your computer. ## What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - A private key without a password, the `key.pem` file. Upload it to Cloud Shell through the **⋮ → Upload** menu. - The Owner or Editor role in the project. ## Step 1. The renewal script In Cloud Shell open the editor with `nano zrazu-gcp-update.sh`, paste the text and save (Ctrl+O, Enter, Ctrl+X). If the certificate already exists in Certificate Manager under another name, change `CERT`; for a regional certificate, change `LOCATION`. ```sh file=zrazu-gcp-update.sh #!/bin/sh # ZRAZU: updates the certificate in Google Certificate Manager using the personal link. Runs once a day. set -eu PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" CERT="zrazu-ssl" LOCATION="global" KEY=/zrazu-key/key.pem cd /tmp curl -fsS --retry 3 --max-time 60 -o new.pem "$PULL/fullchain.pem" grep -q "BEGIN CERTIFICATE" new.pem || { echo "ZRAZU: not a certificate"; exit 1; } current=$(gcloud certificate-manager certificates describe "$CERT" --location="$LOCATION" --format='value(pemCertificate)' | tr -d '\r\n ') if [ "$current" = "$(tr -d '\r\n ' < new.pem)" ]; then echo "ZRAZU: unchanged"; exit 0; fi gcloud certificate-manager certificates update "$CERT" --location="$LOCATION" --certificate-file=new.pem --private-key-file="$KEY" --quiet echo "ZRAZU: updated" ``` ## Step 2. The first certificate (if it is not in Certificate Manager yet) ```sh curl -fsS -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem" gcloud certificate-manager certificates create zrazu-ssl --certificate-file=fullchain.pem --private-key-file=key.pem ``` Add it to the load balancer's certificate map (**Certificate Manager → Certificate maps**) if you have not yet. ## Step 3. The job and the schedule Copy the whole block into Cloud Shell. You can change the job's region to the nearest one. ```sh REGION=europe-west1 PROJECT=$(gcloud config get-value project) SA=zrazu-ssl@$PROJECT.iam.gserviceaccount.com gcloud services enable run.googleapis.com cloudscheduler.googleapis.com secretmanager.googleapis.com certificatemanager.googleapis.com gcloud iam service-accounts create zrazu-ssl --display-name="ZRAZU SSL update" gcloud secrets create zrazu-ssl-key --data-file=key.pem gcloud secrets create zrazu-ssl-script --data-file=zrazu-gcp-update.sh for s in zrazu-ssl-key zrazu-ssl-script; do gcloud secrets add-iam-policy-binding $s --member=serviceAccount:$SA --role=roles/secretmanager.secretAccessor; done gcloud projects add-iam-policy-binding $PROJECT --member=serviceAccount:$SA --role=roles/certificatemanager.editor gcloud run jobs create zrazu-ssl --region=$REGION --image=gcr.io/google.com/cloudsdktool/google-cloud-cli:stable --service-account=$SA --set-secrets=/zrazu-key/key.pem=zrazu-ssl-key:latest,/zrazu-script/update.sh=zrazu-ssl-script:latest --command=/bin/sh --args=/zrazu-script/update.sh --max-retries=1 gcloud run jobs add-iam-policy-binding zrazu-ssl --region=$REGION --member=serviceAccount:$SA --role=roles/run.invoker gcloud scheduler jobs create http zrazu-ssl-daily --location=$REGION --schedule="17 4 * * *" --uri="https://run.googleapis.com/v2/projects/$PROJECT/locations/$REGION/jobs/zrazu-ssl:run" --http-method=POST --oauth-service-account-email=$SA rm key.pem ``` The key is now only in Secret Manager, and it has been removed from Cloud Shell. ## Check 1. Run the job by hand: `gcloud run jobs execute zrazu-ssl --region=$REGION --wait`. 2. Log: **Cloud Run → Jobs → zrazu-ssl → Logs** — "updated" or "unchanged". 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). The Google load balancer may need up to a few minutes. ## If it did not work - `PERMISSION_DENIED` — the service account was not given the role from step 3; repeat the matching line. - An error about the key on `update` — the certificate was reissued with a new key: `gcloud secrets versions add zrazu-ssl-key --data-file=new-key.pem`. - An error about names (SAN) — Certificate Manager updates a certificate only with the same list of domains. If the domains changed, create a new certificate and replace it in the certificate map. - You changed the script — update the secret: `gcloud secrets versions add zrazu-ssl-script --data-file=zrazu-gcp-update.sh`. --- # Cloudflare in front of your site URL: https://zrazu.com/en/docs/ssl-auto-cloudflare/ If your site works through the Cloudflare proxy (the orange cloud in DNS), visitors see the certificate served by Cloudflare, not by your server. ## Free and Pro plans Cloudflare issues a free certificate for visitors itself, and on these plans you cannot upload your own there. Our certificate is needed on **your server**, so that the Cloudflare → server connection is also protected and verified (the **SSL/TLS → Full (strict)** mode). Set up automatic renewal on the server using the guide for it: [Linux server](https://zrazu.com/en/docs/ssl-auto-linux.md), [cPanel](https://zrazu.com/en/docs/ssl-auto-cpanel.md), [Kubernetes](https://zrazu.com/en/docs/ssl-auto-kubernetes.md). ## Business and Enterprise plans — your own certificate in Cloudflare Here you can upload your own certificate (**SSL/TLS → Edge Certificates → Upload Custom SSL Certificate**), but Cloudflare does not renew it. The script below fetches the fresh certificate from the link once a day and updates it in Cloudflare through the API. Run it on any Linux server with `curl` and `openssl`, usually the one behind Cloudflare. ### What you need - The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`. - A private key without a password. An ECDSA key must not have an `EC PARAMETERS` block. - **Zone ID** — on your domain's page in Cloudflare, bottom right (**API → Zone ID**). - **Certificate ID**: **SSL/TLS → Edge Certificates**, your certificate's row → expand → **Certificate ID**. If there is no certificate yet, first upload it manually (the button above) from `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem` with your key. - **API token**: **My Profile → API Tokens → Create Token → Create Custom Token** → permission **Zone → SSL and Certificates → Edit**, **Zone Resources** — only this domain. ### Step 1. Key and script on the server ```sh sudo mkdir -p /etc/ssl/zrazu/example.com sudo chmod 700 /etc/ssl/zrazu/example.com sudo nano /etc/ssl/zrazu/example.com/key.pem sudo nano /usr/local/bin/zrazu-cloudflare-example.com.sh ``` Paste the key into the first file and the script below into the second, with your `ZONE`, `CERT_ID` and `TOKEN`. ```sh file=zrazu-cloudflare-update.sh #!/bin/sh # ZRAZU: updates your own certificate in Cloudflare using the personal link. Run by cron once a day. set -eu PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN" DIR="/etc/ssl/zrazu/example.com" ZONE="ZONE_ID" CERT_ID="CERTIFICATE_ID" TOKEN="API_TOKEN" API="https://api.cloudflare.com/client/v4/zones/$ZONE/custom_certificates" umask 077 cd "$DIR" [ -f cert_id ] || echo "$CERT_ID" > cert_id curl -fsS --retry 3 --max-time 60 -o new.pem "$PULL/fullchain.pem" grep -q "BEGIN CERTIFICATE" new.pem || { echo "ZRAZU: the link does not return a certificate"; exit 1; } if [ -f applied.pem ] && cmp -s new.pem applied.pem; then echo "ZRAZU: certificate unchanged"; exit 0; fi cert_pub=$(openssl x509 -in new.pem -noout -pubkey | openssl sha256) key_pub=$(openssl pkey -in key.pem -pubout | openssl sha256) [ "$cert_pub" = "$key_pub" ] || { echo "ZRAZU: certificate was issued for a different key — put the new key.pem in place"; exit 1; } json() { awk '{ gsub(/\\/, "\\\\"); gsub(/"/, "\\\""); printf "%s\\n", $0 }' "$1"; } printf '{"certificate":"%s","private_key":"%s","bundle_method":"force"}' "$(json new.pem)" "$(json key.pem)" > body.json out=$(curl -sS -X PATCH "$API/$(cat cert_id)" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" --data @body.json) rm -f body.json if printf '%s' "$out" | grep -q '"success": *true'; then id=$(printf '%s' "$out" | tr -d '\n' | grep -o '"result": *{.*' | grep -o '"id": *"[0-9a-f]*"' | head -n 1 | cut -d'"' -f4) [ -z "$id" ] || echo "$id" > cert_id mv -f new.pem applied.pem echo "ZRAZU: certificate updated in Cloudflare" else echo "ZRAZU: Cloudflare refused:" printf '%s\n' "$out" exit 1 fi ``` Cloudflare may give the updated certificate a new ID. The script remembers it in the `cert_id` file by itself. ### Step 2. First run and schedule ```sh sudo chmod 700 /usr/local/bin/zrazu-cloudflare-example.com.sh sudo /usr/local/bin/zrazu-cloudflare-example.com.sh echo "23 4 * * * root /usr/local/bin/zrazu-cloudflare-example.com.sh >> /var/log/zrazu-ssl.log 2>&1" | sudo tee /etc/cron.d/zrazu-cloudflare-example.com ``` ### Check 1. The first run prints "certificate updated in Cloudflare", later runs print "certificate unchanged". 2. **SSL/TLS → Edge Certificates** — your certificate shows a new **Expires On** date. 3. Site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). ### If it did not work - `Authentication error` — the token lacks the **SSL and Certificates → Edit** permission or is not for this domain. - `custom certificate not found` — wrong `CERT_ID`: delete the file `/etc/ssl/zrazu/example.com/cert_id`, fix the line in the script and run it again. - "certificate was issued for a different key" — the certificate was reissued with a new key: replace `key.pem`. --- # Site builders — Tilda, Wix, Shopify, Prom, Horoshop and others URL: https://zrazu.com/en/docs/ssl-auto-site-builders/ If your site is built on a site builder, the builder issues and renews its certificate itself, for free. Installing a ZRAZU certificate there is mostly impossible, and where it is possible, it is only manual and on the most expensive plans. So for a site on a builder **you do not need to buy our SSL**: turn on the free one in the builder's settings. | Builder | Free certificate | Your own certificate | | --- | --- | --- | | Tilda | yes, turned on in the site settings | no | | Wix | yes | Enterprise plan only, manual | | Shopify | yes | no | | Webflow | yes | Enterprise plan only, manual, does not renew by itself | | WordPress.com | yes | no | | Squarespace | yes | no | | Prom.ua | yes, automatically after the domain is connected | no | | Horoshop | yes | no | | Weblium | yes | no | | Google Sites | yes | no | | Framer | yes | no | ## What to do 1. Connect the domain to the builder following its instructions (DNS records in your ZRAZU account, "DNS" section). 2. Turn on the free SSL in the builder's settings if it did not turn on by itself. The certificate usually appears a few hours after the domain starts pointing to the builder. 3. Check: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/). ## When you still need our certificate - **Another site or service on the same domain** (for example, `api.example.com` on your own server) — the certificate is needed there, and there are [guides for servers and hosting](https://zrazu.com/en/docs/ssl-auto.md) for it. - **Wix or Webflow on the Enterprise plan with a requirement for an organization-validated (OV) certificate** — you can upload your own certificate manually; you will have to renew it manually too, before each new part of the subscription. Already bought a certificate for a site on a builder and did not need it? Write to us and we will sort it out. --- # Certificate link — developer reference URL: https://zrazu.com/en/docs/ssl-auto-pull-api/ The personal link gives the current subscription certificate without signing in to your account — for scripts, scheduled tasks and your own integrations. You create it in your account: certificate card → "Installation" → "Link for the server". ## Addresses `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN` is the base address; the file name is added to it: | Request | What it returns | | --- | --- | | `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem` | the site certificate followed by the CA's intermediate certificates — for nginx, Apache 2.4.8+, Caddy, HAProxy, Kubernetes | | `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` | the site certificate only | | `GET https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem` | the intermediate certificates only | The response type is `application/x-pem-file`, PEM text. The link neither gives out nor accepts a private key: the key stays with you, and later parts of the subscription are issued for the same key. ## What is served The current version of the subscription is the latest issued certificate. If it is revoked or expired, the link answers `404`: we do not fall back to the previous version, because the certificate authority may have revoked it on replacement. When the next part of the subscription appears, the same link starts serving it — you do not need to change the link. If the certificate was reissued with a new key, the link will serve a certificate for the new key. So before installing, compare the certificate's public key with your private key, as all the scripts in our guides do: ```sh openssl x509 -in fullchain.pem -noout -pubkey | openssl sha256 openssl pkey -in key.pem -pubout | openssl sha256 ``` The lines must match. ## Response codes | Code | When | | --- | --- | | `200` | the certificate is in the response body | | `304` | conditional request, the certificate has not changed | | `404` | the link is unknown, disabled or expired, or the subscription has no current certificate right now — the response is the same, so it does not reveal whether the link existed | | `429` | too many requests; the `Retry-After` header says in how many seconds you can try again | ## Conditional requests The response contains `ETag` (changes with the certificate version) and `Last-Modified` (issue time). A request with `If-None-Match` or `If-Modified-Since` gets `304` while the certificate is the same: ```sh curl -fsS --etag-save etag.txt --etag-compare etag.txt -o fullchain.pem "https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/fullchain.pem" ``` Conditional requests are optional: the file is small, and comparing it with the installed one (`cmp`) is just as easy. ## Limits - 60 requests per hour per link — plenty for a task that runs once a day or even once an hour; - 300 requests per minute from one IP address. ## Security - Treat the link as a "do not publish" secret: it gives out only the public certificate, but whoever has it can see when the certificate is fetched. - Responses are not cached (`Cache-Control: no-store`), not indexed, and do not pass the link in `Referer`. - We show the link once; only its fingerprint is stored on our side. A new link in the certificate card immediately disables the previous one; "Disable" is in the same place. - The link works until the subscription ends. ## For AI agents The full ZRAZU documentation in a format for language models: [https://zrazu.com/llms.txt](https://zrazu.com/llms.txt) (table of contents) and [https://zrazu.com/llms-full.txt](https://zrazu.com/llms-full.txt) (all pages). Every documentation page is also available as Markdown — add `.md` to the address without the trailing slash. --- # What ZRAZU monitoring checks URL: https://zrazu.com/en/docs/monitoring-checks/ Monitoring in the [cabinet](https://vse.zrazu.com/monitoring/) watches your domains all the time. You do not set up checks by hand: it is enough for the domain to be on the list. ## What we check Each check is a separate "layer". | Layer | What it covers | | --- | --- | | Registry | Whether the domain is switched off, expired, or being moved to another registrar | | Delegation | Whether the domain's DNS servers respond | | DNSSEC | Whether keys and signatures are in place and the registry record matches | | Certificate | Whether the SSL certificate has expired or expires in 7 days or less | | Mail | Whether the domain's mail host works | | Website | Whether the website opens | | CT logs | Certificate Transparency logs for your domain | Not every layer is on every plan, see [plan and adding domains](https://zrazu.com/en/docs/monitoring-add.md). ## Your own and external domains - **Your domains in ZRAZU** are checked automatically every minute, with all layers. They do not count against the free limit. - **External domains** are registered elsewhere. You add them yourself. The free plan covers 25 domains with a check every 15 minutes. If you made a transfer or an NS change through ZRAZU, we know about it and do not treat it as an outage. ## When we decide it is a problem One failed check is not an alarm. An incident opens only when at least two check points confirm the problem and it repeats three times in a row within three minutes. This way a short network glitch does not fill your inbox. Advice such as "set up DMARC" is not an outage. You see it on the domain page, but it will not wake you up. If a layer could not be checked, we say neither "all good" nor "broken". ## What counts as serious We always tell you, even at night, when: the domain is switched off by the registry, the zone does not respond, the domain is being moved to another registrar, the term has expired, or DNSSEC keys or signatures are broken. Read about [notifications and quiet hours](https://zrazu.com/en/docs/monitoring-alerts.md) separately. ## If it didn't work - **The domain is not on the list.** Add it following the [instructions](https://zrazu.com/en/docs/monitoring-add.md). - **The "Website" layer is missing.** It is not available for external domains on the free plan. - **"Paused: plan limit" next to a domain.** You have more domains than your plan allows. Choose a plan with a higher limit. - **Monitoring shows "not checked yet".** The domain was just added, wait for the first check. --- # Add domains to monitoring and the plan URL: https://zrazu.com/en/docs/monitoring-add/ Domains registered with ZRAZU go on monitoring by themselves. Add domains from other registrars manually: you will see their status, term and certificate without moving the registration. ## How to add domains 1. Open the [cabinet](https://vse.zrazu.com/monitoring/add/): the "Monitoring" section, the "Add domains to monitoring" page. 2. Choose a way: - **List**: paste the domains, one per line; - **CSV**: upload a file with the list; - **Cloudflare**: click "Show zones", tick the ones you need and click "Add to monitoring". 3. Read the result: "Added to monitoring", "Already watched", "Over the free limit", "Skipped". Cloudflare needs a read-only key. If a key is already saved in the organization, there is no need to paste it again. The key is a secret: never send it to anyone in a message or chat. Lines we skipped (for example, a typo in the name) can be returned to the field with the "Fix skipped lines" button. ## Free and paid plans | | Free | Paid plans | | --- | --- | --- | | External domains | up to 25 | more, depending on the plan | | Check | every 15 minutes | more often | | Layers | registry, delegation, DNSSEC, certificate, mail | website and CT logs are added | See prices on the [prices page](https://zrazu.com/prices/). Your domains in ZRAZU are checked every minute with all layers on any plan. ## How to subscribe to a paid plan 1. Open the [monitoring plan](https://vse.zrazu.com/monitoring/tariff/). 2. Choose the billing period: monthly or yearly. 3. Click "Subscribe" next to the plan you want. 4. Tick "Start right away" and click "Go to payment". You can pay from the balance or by card. Only a role that pays can subscribe or change the plan. If you already have a paid plan, its unused days are credited against the price of the new one. ## Auto-renew, change and cancel - "Auto-renew": the plan renews itself from the balance at the end of the period. 7 days before that we send an email with the amount. - "Upgrade": switch to another plan. "From next period" schedules the change for later, and "Keep as is" cancels a scheduled change. - "Cancel plan": monitoring goes back to free. Money for the unused days returns to your balance. ## If it didn't work - **"Over the free limit".** The free plan already has 25 domains. Remove extra ones ("Remove from monitoring") or subscribe to a plan with a higher limit. - **"short on the balance".** The renewal did not go through. Top up the balance by the date shown, otherwise the plan falls back to free. - **"Domains paused over the plan limit".** They come back once you pay for a plan with a higher limit. - **"No active Cloudflare key".** Add a Cloudflare key in the organization or paste a read-only token. - **"Cloudflare is slower than usual".** Try again in a minute. - **"The plan is visible to roles with access to domains".** Ask the organization owner to change your role. --- # Monitoring notifications and incidents URL: https://zrazu.com/en/docs/monitoring-alerts/ When [monitoring](https://zrazu.com/en/docs/monitoring-checks.md) confirms a problem, an **incident** opens and you get a notification. When everything is back, we write about that too: "resolved, lasted so many minutes". ## Notification channels Set them up in the [cabinet](https://vse.zrazu.com/settings/notifications/), on the "Notifications" page. | Channel | How to connect | | --- | --- | | Email | Enter the address in "Notification email" and click "Add" | | Telegram | Click "Link Telegram", then "Open in Telegram" | | Webhook | Add an address: https only, port 443, not an internal network, up to three per organization | For a webhook we show the **signing secret** once. Save it right away, it will not be shown again. Every request is signed with a header, so check the signature before trusting the request body. Do not share the secret with anyone. The Telegram link is valid for 15 minutes. If Telegram does not deliver a message, we duplicate it by email. ## What to send The table on this page has categories: "Terms", "Health", "Changes and plans", "Money", "Monthly report". Choose channels for each. Critical alerts cannot be switched off. ## Quiet hours In "Quiet hours" enter a range like `22:00-08:00` and click "Save". During that time ordinary messages wait for the morning digest. Critical alerts always come through: domain switched off, zone not responding, domain being moved away, term expired, DNSSEC problems. ## Incidents All incidents are in "Monitoring → Incidents". An incident card shows: - the state, "ongoing" or "resolved", and the importance: "minor", "important", "critical"; - the "Domains" affected. When several domains break for one reason, we merge them into one incident; - "Checked from several vantage points": where the problem was seen from; - "How we notified": channel and delivery status; - "Timeline". ## What you can do 1. Open the incident from the message or from the list. 2. "Snooze for an hour": we remind you if it has not recovered. 3. "This is expected, don't bother me for a day": for example, you changed the settings yourself. 4. If the cause is a recent DNS change, click "Roll back the change". You can undo it within 60 seconds. 5. Mark whether the alert was accurate ("Yes, it was real" or "No, false alarm"). ## If it didn't work - **Emails do not arrive.** Next to the address it says "This mailbox is not accepting mail". Enter another address. - **Telegram does not link.** The link is valid for 15 minutes, create a new one. - **The webhook is not added.** Check that the address is https, port 443, does not lead to an internal network, and that you have no more than three. - **The change cannot be rolled back.** The zone was changed again after it. Roll back the needed revision in the domain's DNS history. - **"Critical cannot be switched off".** This is a deliberate limit. --- # Getting started: sign-up, sign-in, organization URL: https://zrazu.com/en/docs/account-start/ Everything in ZRAZU — domains, SSL, monitoring, money — lives in the **dashboard**. To use it you need an account (that is you) and an organization (a "folder" that holds domains, the balance and the team). ## Sign up 1. Open the [sign-up page](https://vse.zrazu.com/signup/). 2. Enter your email and choose a password of at least 12 characters. The password is stored only as a hash, never as plain text. 3. If you like, tick the box for personal ZRAZU offers. Without it we don't send them. 4. Click "Save and continue". An email with a link arrives. 5. Open the email and confirm the address with the button on the page it opens. Prefer no password? Use "Sign up with Google". Google gives us only your email; we never see your Google password. ## Sign in The [sign-in page](https://vse.zrazu.com/login/) offers three ways: | Way | How it works | | --- | --- | | **Password** | Email and password. Then, if the second step is on, a code from an app or a passkey. | | **Email link** | Click "Send link" and a one-time sign-in link arrives by email (valid for 15 minutes). No password needed. | | **Passkey** | Sign in with a fingerprint, your face or the device PIN. | There is also "Sign in with Google". We don't use SMS for sign-in — only for notifications. Forgot the password? Click "Forgot your password?" under the form. Can't sign in at all? Use "Can't log in? Recover access" (see [sign-in security](https://zrazu.com/en/docs/account-security.md)). ## Your first organization Right after sign-in the dashboard says "No organization yet". Create the first one: 1. In "Organization name", keep the suggested name or type your own (2 to 200 characters, at least two letters or digits). 2. Click "Create". You become the **owner** of this organization. The whole team sees the name — in the header switcher and in team emails. ## Several organizations Do you manage domains for different companies? Create a separate organization for each: each has its own domains, balance and team. 1. In the dashboard header, open the menu with your current organization. 2. Click "Switch organization" and pick the one you need — or "Create organization". One person can own no more than 10 organizations. Your role in each organization is separate. ## Organization name and details Settings → Organization: - Only the **owner** can change the name: type a new one and click "Save". - Your role in the organization is shown here as well. - Details for invoices and acts live in Billing → Payer profiles ([see invoices and payers](https://zrazu.com/en/docs/account-documents.md)). Your personal profile (name, email, language of emails) is under Settings → Profile. ## If it didn't work - **"Wrong email or password"** — check the address, keyboard layout and Caps Lock. - **"Confirm your email to sign in"** — the password is right but the address isn't confirmed yet. We just sent a new email; check "Spam" or click "Log in" again. - **"Too many attempts"** — sign-in is paused for a few minutes: that is how we protect the account from password guessing. Wait, or reset the password. - **"That code didn't work"** — take a fresh code from the app (it changes every 30 seconds) and enter it again. Also check the time on your phone. - **"An account with this email already exists"** when signing in with Google — sign in with a password, an email link or a passkey, then connect Google under "Sign-in security". - **"You can own no more than 10 organizations"** — the limit is reached; hand one organization over to another owner. --- # Team and roles in an organization URL: https://zrazu.com/en/docs/account-team/ Under Team → People and access you see everyone who works in the organization, their roles and the invitations still waiting. Owners and administrators manage the team. ## Roles A role defines what a person can do. API keys are never stronger than their role: a key can't do more than its owner. | Role | What it can do | | --- | --- | | **Owner** | Everything, including moving domains to another registrar (the transfer code), renaming the organization and managing owners | | **Administrator** | Domains, DNS, domain contacts, the transfer lock, monitoring, money and documents, the team, API keys | | **Technician** | See domains, change DNS, set up monitoring, issue API keys; no money | | **Accountant** | See domains and the balance, pay and top up the balance, download invoices and acts; no DNS | | **View only** | See domains, the balance and invoices; changes nothing | An organization always keeps at least one owner. ## How to invite a person 1. Open Team → People and access and click "Invite". 2. Enter your colleague's email and choose a role. 3. Click "Send invitation". The colleague gets an email with a link. The invitation is valid for 7 days. Signing in through it requires two-step verification — the colleague sets it up while signing in. Until accepted, the invitation is marked "invited …, not accepted yet"; you can withdraw it with "Cancel invitation". ## Change a role or remove a person 1. Find the person in the list and choose a new role in their row — they get an email about it. 2. To remove them, click "Remove from team". You can undo this within 60 seconds. You can't demote or remove yourself in this list. ## Owners: extra care The owner role gives the most rights, so special rules apply: - Only an owner can grant the owner role, take it away or remove an owner — and only after an explicit "Yes, confirm". - A new owner gets the domain transfer code only after 72 hours, and during those 72 hours can't demote or remove you. - Invite someone as owner only if you know them personally. ## If a colleague's access was recovered When a colleague has recovered access to their account (for example, lost a phone), the list shows "Restricted after access recovery until …" next to them. Until that date they can't change name servers, contacts or the team of this organization. If you are sure it really is them, click "Confirm it's really them". Check by voice or in person, not by email or a messenger from this account: an attacker may have recovered it. Confirming lifts the restriction. ## Sign-in log At the bottom of the page is the "Sign-in log" for 30 days: who signed in, when, from where and how, whether it was a new device and whether a sign-in was rejected because of a wrong code. People who manage the team can see it. ## If it didn't work - **"The address looks wrong"** — check your colleague's address. - **"This person is already on the team"** — no need to invite again. - **"The invitation is invalid or expired — ask for a new one"** — the 7 days have passed or the invitation was withdrawn. Send a new one. - **"A different role in the organization is needed for this"** — only an administrator or an owner can do this. - **"Only an owner can change an owner's role"** / **"Only an owner can remove an owner"** — ask an owner to do it. - **"The organization must keep at least one owner"** — make someone else an owner first. --- # Sign-in security: passkey, code, sessions URL: https://zrazu.com/en/docs/account-security/ A ZRAZU account controls domains and money, so it is worth protecting with a second sign-in step. Set it up under Settings → Sign-in security. ## The second sign-in step The second step is what we ask for after the password. There are two ways; one is enough: - **Passkey** — your device's fingerprint, face or PIN instead of a code. Faster than a password, and it can't be stolen on a fake site. - **Code from an app** — six digits from an authenticator app (Google Authenticator, Authy, 1Password). We don't use SMS for sign-in — only for notifications: a phone number is easy to hijack. Without a second step, sign-in relies on the password alone, and risky domain actions (such as changing name servers or removing the lock) stay closed until you set it up. After sign-in the dashboard may offer to set it up — choose "Create a passkey" or "Code from an app". "Later" reminds you in a month, "Don't ask again" turns the reminder off. ## Add a passkey 1. Open "Sign-in security" and, under "Passkeys", click "Add a passkey". 2. Give it a name ("phone", "laptop") so you can recognize it later. 3. Confirm with a fingerprint, face or PIN in the browser window. Next to each key you see when it was added and when it was last used. Click "Remove" to delete it — except the last way to confirm sign-in. ## Connect a code from an app 1. Under "Code from an app", click "Connect". 2. Scan the QR code with the app. If that doesn't work, enter the shown secret manually. 3. Type the six-digit code and click "Confirm". The status changes to "connected". To switch phones, use "Replace app". The secret and the QR code are a key to your account: never show them to anyone or send them in a chat. ## Backup codes When you connect a second step we show 10 single-use backup codes. You need them if you lose your phone. - Save them right away: download the file or click "Copy all". We won't show them again. - Each code works once. How many are left is shown under "Backup codes". - "Regenerate" creates new ones; the old ones stop working. ## Password and email - **Change password** — enter the current one and the new one (at least 12 characters). Other sessions are closed afterwards. - **Set a password** — if you signed up with Google or sign in by link, you can set a first password without an old one, confirming with a code. - **Change sign-in email** — enter the new address and click "Send confirmation". A confirmation email goes to the new address and a warning to the current one. After you change the password or email, domain transfers are unavailable for 72 hours: no transfer code is issued meanwhile. That way nobody can take a domain right after a break-in. ## Sign in with Google You can connect Google with "Connect Google". Google replaces only the password: risky actions still need a second step. You can disconnect Google if you have a password or a passkey. ## Sessions Under "Sessions" you see the devices you are signed in on. Yours is marked "this device". - "Sign out" closes one session. - "Sign out everywhere except here" closes the rest. We close inactive sessions ourselves. For every sign-in from a new device we send an email with a "Not me" button. ## If you lose access Open "If you lose access" → "How to recover access". The path depends on your situation: | Situation | What happens | | --- | --- | | Email yes, phone no | Confirm by email; we reset the second step after 24 hours, notifying all your contacts | | Neither email nor phone | An ID document and account history, 72 hours of waiting, confirmed by a second person | | A company | A request on letterhead, a state register check, 72 hours and two staff members | We never verify identity by phone. When in doubt, we refuse — even if you really are the owner: better to wait than to lose the domain. Do you have backup codes? Then just enter one of them instead of the app code on the sign-in step — and after signing in, replace the app and generate new codes. ## If it didn't work - **"The code didn't match — check the time on your phone"** — the code depends on time; turn on automatic time. - **"This is the last way to confirm sign-in"** — add another key or app first, then remove this one. - **"The current password didn't match"** — check the layout and Caps Lock, or use "Forgot your password?" on the sign-in page. - **"This Google account is already connected to another ZRAZU account"** — use a different Google account. - **"To connect Google, confirm your sign-in again"** — sign in again and repeat. --- # Balance and payment: card and IBAN invoice URL: https://zrazu.com/en/docs/account-balance/ ZRAZU services are paid from the organization's **balance**. You top the balance up by card or by bank transfer against an invoice; an order can also be paid directly at checkout. Current prices are on the [prices page](https://zrazu.com/prices/). ## Where the balance is The balance amount is always visible in the dashboard header. Click it to see the breakdown and the "Top up" button. The full money history is on the "Money movements" page, and what was ordered and paid is under Billing → Orders. An organization may have more than one balance: one per seller — "with VAT" and "without VAT". An order is paid from the balance of the mode that matches your payer. See [invoices and documents](https://zrazu.com/en/docs/account-documents.md) for payers. Bonuses (if any) are shown separately from your own money and can't be withdrawn. The owner, an administrator or an accountant can top up the balance and manage cards. ## Top up the balance Open Billing → Payment methods. Topping up takes three steps: 1. **Whom you pay** — choose "With VAT" (for VAT payers) or "No VAT" (for individuals and non-VAT payers). 2. **How you pay** — "By card" (the money is on the balance at once) or "Invoice" (a transfer to IBAN, credited once the money arrives). 3. **How much** — pick an amount or type another one in whole hryvnias. A single card top-up is limited to a certain amount — the form shows it; pay a larger amount by invoice. ### By card 1. Choose a saved card or "New card on the bank's page". 2. If you like, keep the "Save the card for future top-ups" box ticked. 3. Click "Pay … on the bank's page" and enter the card details on the bank's page. You enter the card number only on the bank's page; we keep only the mask and the bank's token. If a card payment carries a fee, the form shows it and the amount "you pay" before you click the button. ### By invoice to IBAN 1. Choose "Invoice", enter the amount and the payer the invoice is for. 2. Click "Issue invoice". 3. Copy the details (recipient, IBAN, code, bank, MFO, payment purpose) — each line copies separately — and pay from any banking app. You can open the invoice for print or PDF. Copy the payment purpose exactly: we find the transfer in the statement by the invoice number. We credit the amount that actually arrived. If you transferred less, pay the difference with the same purpose. Invoices with the statuses "Awaiting payment", "Credited …" and "Cancelled" are listed under "Your invoices". If you have already paid, don't cancel the invoice. ## Saved cards The "Payment methods" page has a "Saved cards" section: - "Make primary" — the default card; - "Delete" — the card is deleted and the bank's token erased at once; past payments stay in the history; - a card is stored with the seller it was entered for: a card of one mode can't be used for the balance of the other. When a card is about to expire, the dashboard asks you to add a new one. ## Pay for an order After you check out the cart, the payment step opens: - **By card** — pay on the bank's page. If the balance covers part, the dashboard shows "By card …, another … from the balance". - **From the balance** — if it is enough, click "Pay from balance". - **By invoice (IBAN)** — the details appear on the page; as soon as the bank processes the transfer, the order is paid by itself. You can close the page: the state is always visible under "Orders". If part of the amount is already on the balance, click "Use my balance" — the invoice will be for the difference only. The “Payer on the invoice and act” field under the payment ways decides who the invoice and act are issued to — see [Invoices, acts and payers](https://zrazu.com/en/docs/account-documents.md). After payment we register the domain with the registry, usually within a minute. Transferring a domain from another registrar takes up to 5 days. Until an SSL certificate is issued, the money for it is refunded in full. ## One-off work ("Charges") Sometimes we prepare a one-off service outside the price list. It appears under Billing → Orders for your approval: first you approve a spending limit with "Approve", then we work and charge only the actual costs; the rest comes back. We won't charge above the limit without your consent. If you disagree, click "Decline". ## If it didn't work - **"The bank declined the payment — no money was taken"** — try another card or an IBAN invoice. - **"The bank hasn't replied yet — we'll credit it as soon as it does"** — wait. If the bank confirmed the payment, the money is already on the balance: check "Money movements". - **"The bank declined the payment or it didn't complete"** on the order page — no money was taken and no domains were registered. Pay again. The names aren't reserved: while you retry, someone else may register them. - **Names were taken while you were checking out** — they didn't enter the order amount; you can pay for the rest. - **"Card payment for this seller isn't connected yet"** — top up by invoice transfer. - **Money was taken but the order isn't paid** — write to [support](https://zrazu.com/en/docs/account-support.md) with the order number. - **The order couldn't be fulfilled** — the ZRAZU team returns the money to the balance. --- # Invoices, acts and payers URL: https://zrazu.com/en/docs/account-documents/ Invoices and acts are what accounting needs. They are issued to a **payer** — a company, a sole proprietor, a private person or a non-resident. The role with access to money can see and download them: accountant, administrator or owner. ## Payers Billing → Payer profiles. While there are no payers, documents are issued to a private person. To have invoices and acts issued to a company or sole proprietor, add it. 1. Click "Add a payer". 2. Choose the type: company, sole proprietor, individual or non-resident. The type decides the VAT mode: documents with VAT for a VAT payer, without VAT for the others. 3. Enter the name as it must appear on the invoice, for example "Kava LLC" or "Olena Koval, sole proprietor". 4. Enter the code: EDRPOU is 8 digits, RNOKPP is 10 digits. For a VAT payer add the VAT number (IPN: 12 digits for a company, 10 for a sole proprietor). 5. If you like, fill in the address — we print it on the invoice and act — and the email for documents. 6. Click "Save the payer". If the payer already has payments, its name, type and codes can't be changed so that past documents are not rewritten. If the details changed, add a new payer and click "Archive" on the old one: we won't issue new documents to it, past ones stay as they are. ## Where invoices and acts are Billing → Invoices and acts, the "Documents" tab. Each row is an invoice or an act of services with its number, date, orders, status and amount. | Status | What it means | | --- | --- | | awaiting payment | the invoice is issued, the money hasn't arrived yet | | paid | the payment is credited | | partly paid — pay the rest | only part of the amount arrived | | not needed — orders paid | the orders were paid another way | | cancelled | the invoice is cancelled | | done | an act: the service has been provided | An invoice appears when you issue it for a top-up or to pay for orders; an act appears when an order is fulfilled. When you pay for an order, the “Payer on the invoice and act” field decides who the documents are issued to. If there is one payer in the order’s mode (with or without VAT), it is selected right away; if there are several, pick the one you need. The chosen payer becomes the payer of the order: both the invoice and the act are issued to it, whether you pay from the balance, by card or by transfer. No payer yet — the “Add a payer” link is next to the field. ## How to download 1. Click the number of the document you need — its page opens. 2. Click "Print" or "Save PDF". Acts in the dashboard are copies without a signature. We'll send a signed copy on request: write to [support](https://zrazu.com/en/docs/account-support.md). ## Money history and export The "Transaction history" tab shows every balance operation in plain words: when, what, from which wallet ("Funds" or "Bonus") and for what amount. History isn't changed retroactively: corrections are separate entries. The "Export CSV" button downloads the history as a file that is handy to hand to an accountant. ## If it didn't work - **"Invoices and payment history are available to roles that can view payments"** — your role has no access to money; ask an owner to change the role (see [team and roles](https://zrazu.com/en/docs/account-team.md)). - **"No documents here yet"** — nothing has been issued or fulfilled yet. - **"Choose a country from the list"** when adding a non-resident — pick the country from the drop-down list. - **You can't see a payer in the list** — check that it isn't archived. --- # Contacting support from the dashboard URL: https://zrazu.com/en/docs/account-support/ All your requests are collected under "Requests". It is one thread across all channels: write by email, Telegram or the dashboard chat — the whole conversation gathers in one place, and you can reply from wherever suits you. ## Where you can write from - **Dashboard chat** — the "New request" button at the top of the section. - **Email** — a message to the support address from your account's email. - **Telegram** — the bot linked via a one-time link from the dashboard. - There's no phone line: we can't verify your identity by phone and won't try. ## A new request in the dashboard 1. Open "Requests" and click "New request". 2. Choose a topic: "Domain and DNS", "Mail", "Money and documents", "Sign-in and access" or "Other". 3. If needed, choose the domain it concerns. 4. In "What happened", describe the domain, what you see and what you expected. At least one sentence. 5. Attach a screenshot or document with "Attach a file": up to 5 files at once, no more than 10 MB together. We don't accept executable files. 6. Click "Send". The request gets a number. The list shows its state: "received", "in progress", "waiting for you" or "closed". The "Open", "Closed" and "All" filters help you find what you need. ## When we reply A regular question — by the end of the next working window. The reply time for a specific request is shown in the list. ## What support doesn't do Changing the owner, changing name servers, issuing a transfer code and withdrawing money — only you, in the dashboard. If you ask for such a thing by email or in Telegram, we answer with a "confirm in the dashboard" link: that way nobody can do it in your name. Never send passwords, app codes or backup codes to anyone — not by email, not in a chat. ## If it didn't work - **"No more than 5 files at once"** / **"Files together — no more than 10 MB"** — attach fewer files or compress them. - **"The request was closed long ago — create a new one"** — you can't reply to the old one; open a new request. - **"Too many requests"** — wait a little and try again. If it's urgent, write by email. - **"Enter the email to reply to"** or **"Check the account email"** — make sure the email in your profile is correct and confirmed. --- # ZRAZU API — developer overview URL: https://zrazu.com/en/docs/api-overview/ The ZRAZU API gives scripts and programs what you do in the cabinet: read the list of domains, DNS zones and certificates, put a domain under monitoring. It works with a key that you issue yourself. Separately there is [MCP for AI agents](https://zrazu.com/en/docs/api-mcp.md): it is open, needs no key, and only reads and shows the passport of a public domain. ## What the API does with a key Base address: `https://api.zrazu.com/v1`. | Group | What you can do | | --- | --- | | Key | `GET /v1/api-keys/current` — which rights, domains and term this key has | | Domains | `GET /v1/domains` — the organization's domains with term, auto-renewal and locks | | Monitoring | `GET /v1/monitoring`, `POST /v1/monitoring`, `DELETE /v1/monitoring/{name}` — read, add and remove names | | DNS | `GET /v1/dns/zones`, `GET /v1/dns/zones/{name}`; editing records and new zones — see [domains and DNS through the API](https://zrazu.com/en/docs/api-domains-dns.md) | | SSL | `GET /v1/ssl/catalog`, `GET /v1/ssl/certificates`, certificate files, ordering and reissue | | Balance | `GET /v1/balance` — the organization's balance | What your key can do depends on its rights: see [API keys](https://zrazu.com/en/docs/api-keys.md). The API cannot register or renew domains, change contacts or locks, or get a transfer code. This is deliberate: those actions stay in the cabinet. ## Signing in with a key Send the key only in a header: ```sh curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/api-keys/current ``` A key in the request address (`?key=…`) is refused: addresses end up in server and browser logs. The key starts with `zr_live_`. A key placed in the code of a web page will not work: the API does not accept requests from other sites' pages in the browser, and this is intentional. ## Safe retries of changes Every request that changes something (`POST`, `PUT`, `DELETE`) needs an `Idempotency-Key` header — any string up to 120 characters, for example a UUID. ```sh curl -X POST https://api.zrazu.com/v1/monitoring \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: 6f1d8c0e-5b2a-4c1f-9a3e-0d7b2e4a1c11" \ -H "Content-Type: application/json" \ -d '{"names": ["example.com.ua"]}' ``` - A repeated request with the same key within 24 hours returns the first response with the header `Idempotent-Replayed: true` — the change is not made twice. - The same `Idempotency-Key` with a different request body gives error `422`. - If the first request is still running, the repeat gets `409` — retry in a moment. If the key was issued with “Changes only with my confirmation”, the change is not made at once: the API answers `202` and a `plan_id`, and a person confirms the plan in the cabinet under “Plans”. ## Response and error format Lists come in pages: `{"data": [...], "next": "…"}`. To get the next page, pass `next` as the `after` parameter; `limit` is up to 500, 100 by default. An error always has the same shape: ```json { "error": { "code": "right_missing", "message": { "uk": "…", "en": "…" } } } ``` `code` is stable — rely on it in your code; the `message` text may change. | Code | HTTP | Meaning | | --- | --- | --- | | `key_required` | 401 | no `Authorization: Bearer zr_…` header | | `key_invalid` | 401 | not a ZRAZU key, or a mistake in it | | `key_unknown` | 401 | key not found | | `key_revoked`, `key_expired`, `key_idle` | 401 | key revoked, term over, or not called for 90 days | | `key_in_query` | 400 | key passed in the request address | | `ip_not_allowed` | 403 | the key does not work from this IP address | | `right_missing` | 403 | the key lacks the needed right | | `out_of_scope` | 403 | the name is outside the key's domains | | `not_found` | 404 | zone or certificate not found | | `idempotency_key_required` | 400 | no `Idempotency-Key` header | | `idempotency_key_reused` | 422 | `Idempotency-Key` already used with another request | | `rate_limited` | 429 | too many calls; the `Retry-After` header says how many seconds to wait | ## Limits | What | Limit | | --- | --- | | One key | 120 calls per minute and 25 times that per hour | | One IP address | 240 calls per minute | | Changing calls of an organization | 1000 per day — all keys together | For some organizations the per-minute limit may differ. A `429` response carries `Retry-After`: wait that many seconds and repeat the request with the same `Idempotency-Key`. ## If it didn't work - **`401 key_required`.** Add the header `Authorization: Bearer zr_live_…` — the word `Bearer` and a space before the key. - **`401 key_unknown` or `key_invalid`.** Check that the key was copied in full, without a trailing space. If you lost the key, issue a new one: the old one cannot be shown again. - **`403 right_missing`.** The key lacks the right. Open `GET /v1/api-keys/current`, look at `permissions`, and if needed issue a new key with the right. - **`403 ip_not_allowed`.** The key has a list of IP addresses and the request came from another. Add the address in the cabinet or issue a new key. - **`429 rate_limited`.** Slow down and respect `Retry-After`. - **`400 idempotency_key_required`.** Add the `Idempotency-Key` header to a request that changes data. Prices for services are on the [prices page](https://zrazu.com/prices/). --- # API keys — how to create and restrict URL: https://zrazu.com/en/docs/api-keys/ An API key is a password for a program. It allows only what you choose: specific actions on specific domains. A key is never stronger than the person who issued it, and it is checked on every call. Keys are visible to the owner, administrators and technicians of the organization. ## Create a key 1. Open the [cabinet](https://vse.zrazu.com/team/api-keys/) → “Team” → “API keys”. 2. Click “New key”. 3. “Template” step: pick a ready set (“Read only”, “Monitoring”, “SSL certificates”, “DNS zones — for a manager”, “DNS zones — full access”) or “Custom set”. 4. “Rights” step: change what exactly to allow, if needed. 5. “Domains” step: “All domains of the organization, including future ones” or “Selected only” (up to 100 domains). 6. “Conditions” step: name, whose key, allowed IP addresses, lifetime. 7. “Summary” step: check what the key will be able to do and click “Confirm sign-in and issue”. 8. Copy the key with the “Copy” button and store it in a password manager or your service's secrets. Click “I have copied the key”. The key is shown once. We keep only its fingerprint and cannot show the key a second time. If you lose it, revoke it and issue a new one. The key looks like `zr_live_…` followed by a long string. Never paste it into chats, emails or the code of web pages. ## Rights Rights are named “what.action”. The class shows the worst consequence: 0 — reading, 1 — reversible changes, 2 — money. | Right | What it allows | Class | | --- | --- | --- | | `domain.read` | read domains, terms and locks — without contacts | 0 | | `monitor.read` | read the monitoring state | 0 | | `monitor.edit` | put domains under monitoring and take them off | 1 | | `dns.read` | read DNS zones and their records | 0 | | `dns.edit` | edit zone records and check delegation — with an email and a log entry | 1 | | `dns.zone_create` | add new zones — only a key for all zones | 1 | | `keys.zones_grant` | add and remove zones in other keys of the organization — rights and term stay unchanged | 1 | | `ssl.read` | read certificates and download their files | 0 | | `ssl.reissue` | reissue a certificate with a new key within the paid term | 1 | | `ssl.order` | order certificates from the organization balance | 2 | | `billing.read` | see the organization balance — without invoices and payments | 0 | The `dns.zone_create` and `keys.zones_grant` rights work only for a key covering all domains and zones of the organization. A key cannot do more than your role in the organization: if your role does not allow a right, it is unavailable in the cabinet. ## What a key can never do Register or renew domains, change contacts or locks, get a transfer code, revoke certificates. A key also cannot manage people and keys, payment methods, the second factor and sign-in email, or delete the account. These actions exist only in the cabinet. ## Key conditions - **Name** — for you, to tell the key apart in the list; up to 80 characters. - **Whose key.** “Personal” stops working if you are removed from the organization. “Organization” — for CI and integrations, it outlives changes of people. - **Allowed IP addresses** — one address or network (CIDR) per line, up to 20. The key will work only from them. For a key with the `ssl.order` right the list is required: such a key spends money. - **Lifetime.** Class 0: 365 days by default and at most. Class 1: 90 days by default, at most 365. Class 2 (money): 30 days by default, at most 90. - **“Changes only with my confirmation”.** The key will propose a change as a plan, and you apply it in “Plans”. For SSL and DNS zones this option is not available yet. A key that nobody has called for 90 days switches itself off: a forgotten key in an old repository is the most common source of leaks. ## Revoke a key 1. Open “Team” → “API keys”. 2. In the key's row click “Revoke” and confirm: “Yes, revoke”. The key stops working at once. If you suspect a leak and do not know which key, click “Revoke all”: every active key of the organization (for a technician — your personal ones) stops immediately. A sign-in confirmation is required. ## Check that the key works ```sh curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/api-keys/current ``` The response shows the key's rights, domains, allowed IPs and term. For details on calls see the [API overview](https://zrazu.com/en/docs/api-overview.md). ## If it didn't work - **No “API keys” item.** Keys are visible to the owner, administrators and technicians. Ask the organization owner to change your role or to issue a key. - **A right is inactive and says “your role does not allow this”.** A key cannot have a right your role lacks. - **The issue button asks to confirm sign-in.** This is protection: issuing a key requires confirming your sign-in again. - **Too many keys.** An organization can have up to 50 active keys and up to 20 new ones per day; revoke those you no longer need. - **The key returns `401 key_expired` or `key_idle`.** The term is over or the key was not called for 90 days — issue a new one. --- # Domains and DNS through the API — examples URL: https://zrazu.com/en/docs/api-domains-dns/ All examples use the placeholder key `zr_live_...`. Substitute your own key from the [cabinet](https://vse.zrazu.com/team/api-keys/). General rules (sign-in, retries, errors, limits) are in the [API overview](https://zrazu.com/en/docs/api-overview.md). ## List domains Needs the `domain.read` right. ```sh curl -H "Authorization: Bearer zr_live_..." "https://api.zrazu.com/v1/domains?limit=100" ``` For each domain the response has `name`, `expires_at`, `autorenew`, `transfer_lock`, `contact_lock`, `frozen`. If there are more pages, pass `next` from the response as `after`. ## Monitoring Rights `monitor.read` and `monitor.edit`. ```sh # monitoring state curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/monitoring # put up to 100 names under watch per call curl -X POST https://api.zrazu.com/v1/monitoring \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ -d '{"names": ["example.com.ua", "example.net"]}' # take off watch curl -X DELETE https://api.zrazu.com/v1/monitoring/example.net \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: $(uuidgen)" ``` In the response to an add, the `skipped` field lists the lines that could not be accepted, with a reason: a typo does not vanish silently. ## Read a DNS zone Needs the `dns.read` right. ```sh # list of zones curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/dns/zones # records of one zone curl -H "Authorization: Bearer zr_live_..." https://api.zrazu.com/v1/dns/zones/example.com.ua ``` Response to the second request: ```json { "name": "example.com.ua", "serial": 12, "records": [ { "name": "@", "type": "A", "ttl": 300, "content": "203.0.113.10", "prio": null }, { "name": "www", "type": "CNAME", "ttl": 300, "content": "example.com.ua.", "prio": null } ] } ``` Record names are relative to the zone: `@` for the zone itself, `www` for `www.example.com.ua`. You will need `serial` to make a change. ## Change zone records Needs the `dns.edit` right. The flow: read the zone, change the list, send it back whole together with `base_serial` — the number you read. ```sh curl -X PUT https://api.zrazu.com/v1/dns/zones/example.com.ua \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ -d '{ "base_serial": 12, "summary": "new site server", "records": [ { "name": "@", "type": "A", "ttl": 300, "content": "203.0.113.20" }, { "name": "www", "type": "CNAME", "ttl": 300, "content": "example.com.ua." } ] }' ``` - The list must contain **all** records of the zone, not only the changed ones: what you do not send is deleted. - A zone holds up to 500 records. - If the zone changed between your read and write, the answer is `409`: read the zone again and repeat. - Before saving, the zone is checked the same way as in the cabinet: an error in a record gives `409` with no changes, warnings come back in the `warnings` field. - After a change, owners and administrators get an email, and the change stays in the zone history under the key's name. At most 60 changes per hour per key. ## New zone and delegation check Needs the `dns.zone_create` right — only for a key covering all zones of the organization. ```sh curl -X POST https://api.zrazu.com/v1/dns/zones \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ -d '{"name": "example.com.ua", "import_current": true}' ``` - For a domain registered with ZRAZU, the zone is turned on at our nameservers. With `import_current: true` the records that currently answer at the previous provider are carried over. - For a domain at another registrar a request is created. Set the nameservers from the response at that registrar, then start the check: ```sh curl -X POST https://api.zrazu.com/v1/dns/zones/example.com.ua/verify \ -H "Authorization: Bearer zr_live_..." \ -H "Idempotency-Key: $(uuidgen)" ``` Answer `202` means the check has started. Call `GET /v1/dns/zones` later to see the status. ## If it didn't work - **`403 right_missing`.** The key lacks the needed right — see [API keys](https://zrazu.com/en/docs/api-keys.md). - **`403 out_of_scope`.** The domain is outside the key's domain list. - **`404 not_found`.** The zone does not exist, is not yours or is outside the key's domains — the answer is the same. - **`409` on `PUT`.** The zone changed after you read it, or the records contain an error. Read the zone again and repeat with the new `base_serial`. - **`503 dns_closed`.** ZRAZU DNS temporarily doesn’t accept changes; try later. - **`409 zone_exists`.** The zone for this domain already exists. - **`429`.** Too many changes: wait `Retry-After` seconds. --- # MCP for AI agents — domain passport URL: https://zrazu.com/en/docs/api-mcp/ MCP is a way to give an AI assistant access to an external tool. The ZRAZU server is open: no key and no registration. It has one tool — the domain passport — and only reads. ## What the agent gets A domain passport: who the registrar is, when the domain was registered and when it expires, registry statuses in plain language, when the name may become available, nameservers, and the state of DNS, the site certificate and mail with ready fixes. - Nothing can be changed through MCP: not a domain, not records, not an invoice. - We never give out the domain owner's personal data. - MCP never says “available”. Only the registry can prove a name is free, and only at the moment of purchase. If the sources did not confirm that the domain is taken, the answer is “could not check”. ## Connect Server address: `https://api.zrazu.com/mcp`. Authentication — “none”. **Claude, ChatGPT and other clients with remote MCP servers.** 1. Open the connections (connectors) settings of your client and add a custom MCP server. 2. Enter the address `https://api.zrazu.com/mcp`. 3. In the authentication field choose “none”. **Claude Code:** ```sh claude mcp add --transport http zrazu https://api.zrazu.com/mcp ``` **Cursor, VS Code and other clients with a JSON configuration:** ```json { "mcpServers": { "zrazu": { "type": "http", "url": "https://api.zrazu.com/mcp" } } } ``` The transport is Streamable HTTP. Each request is a separate POST, the answer is one JSON. ## The `domain_passport` tool Input — `domain`: a domain name (`kava.com.ua`), a page address (`https://kava.com.ua/menu`) or an email address (`hello@kava.com.ua`). The domain is extracted automatically, up to 300 characters. Example request to an agent: “Check kava.com.ua: when does it expire and is the mail fine?” Output — the passport as JSON and the same as text: | Field | What it is | | --- | --- | | `state` | `taken` — the domain is taken; `unknown` — could not check | | `phrase` | one sentence about the domain in plain language | | `bars` | four status bars: `domain`, `dns`, `site`, `mail` | | `statuses` | registry statuses with an explanation | | `lifecycle` | stage, registration and expiry dates, when the name may become available | | `nameservers`, `registrar` | nameservers and registrar | | `problems` | problems found, what they risk, a ready fix | | `checked_at` | when exactly it was checked | If the name could not be checked, the answer is short: `state: "unknown"`, a reason `reason` and `retry: true` — worth asking later. ## Manual request A session starts with `initialize`; the server returns a session number in the `Mcp-Session-Id` header. The number is valid for 24 hours. ```sh curl -si https://api.zrazu.com/mcp -H 'content-type: application/json' \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"curl","version":"1"}}}' \ | grep -i mcp-session-id curl -s https://api.zrazu.com/mcp -H 'content-type: application/json' -H 'Mcp-Session-Id: ' \ -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"domain_passport","arguments":{"domain":"kava.com.ua"}}}' ``` ## Limits | What | Limit | | --- | --- | | Passport through MCP | 30 per minute and 300 per hour per session | | All sessions from one address | 10 times more | | New sessions from one address | 600 per hour | The passport is cached for up to 6 hours (15 minutes for a domain in the deletion queue). The `checked_at` field shows when it was checked. ## Privacy Each request is logged without your address and without the domain name: only the tool, the result and the time. Every name that is checked goes onto a stop list for 90 days: we do not take it for ourselves, and the stop list holds a fingerprint of the name, not the name. ## If it didn't work - **A `404` answer.** The session number has expired (valid for 24 hours). Start with `initialize` again. - **A result with `isError: true`.** The agent sent a name without a zone, an IP address instead of a domain, or a string that is too long. The error text can be shown to a person. - **`state: "unknown"` and `retry: true`.** The sources did not confirm the state or the limit is used up. Ask again in a few minutes. - **The client asks for a key.** Choose “none”: no API key is needed here. - To work with your own domains (list, DNS, certificates), use the [API with a key](https://zrazu.com/en/docs/api-overview.md). --- # How to become a ZRAZU reseller URL: https://zrazu.com/en/docs/resellers-program/ A reseller sells .UA domains and SSL certificates to its own customers from its own billing, and buys from ZRAZU at wholesale prices. It suits hosting providers, registrars and anyone who already keeps customer records in a billing system (WHMCS, BILLmanager, HostBill and others). If you are a web studio and just want to manage your clients' domains in one cabinet, you need a different program: the [web studio cabinet](https://zrazu.com/en/docs/resellers-studio.md). ## How it works There is one route, and all of it goes through the cabinet, with no emails to support: 1. A form in the cabinet. 2. A contract. 3. A sandbox to check your module. 4. A live login. Your old supplier can keep working in parallel: you do not have to switch everything at once. ## Step 1. Submit the form The form is submitted by the organization's owner or administrator, because they sign the contract. For other team members the cabinet shows only the status of the application. 1. Sign in to the [cabinet](https://vse.zrazu.com/reseller/) and open the "Reseller" section. If your organization is not a reseller yet, you will see a "Become a reseller" page. 2. Choose your billing. We have ready-made domain and SSL modules for WHMCS. Any other billing connects via the EPP manual: enter its name. 3. Tick the zones you plan to sell ("All" or individual ones) and whether you will sell SSL. 4. Enter how many new domains per month you expect. A rough guess is fine: it is only for the start. 5. Enter the EDRPOU (8 digits, a company) or the sole proprietor's tax number (10 digits). The contract will be signed with this entity. 6. Enter who signs the contract: full name, phone and email. The website and comment are optional. 7. Click "Send the application". ## Step 2. Wait for the answer After you submit, the cabinet shows "Application received". A manager will contact you at the email from the form, usually within two business days, to agree on the contract. If the application is declined, the cabinet shows "The previous application was declined" with the reason. You can then submit a new one. ## Step 3. Sandbox and live login After the contract, in "Reseller" → "EPP connection" you create the sandbox login yourself, connect your module to it and run your usual scenario: registration, transfer and so on. Money in the sandbox is test money. Your manager sets up the live login after the check. Details: [EPP connection](https://zrazu.com/en/docs/resellers-epp.md). WHMCS also needs modules: [modules for WHMCS](https://zrazu.com/en/docs/resellers-whmcs.md). ## What the reseller takes on The connection is governed by the contract. The reseller: - verifies its customers and their right to manage the domain; - is responsible for the accuracy of the domain owner data passed in contacts; - accepts abuse complaints about its customers and meets our requirements within the agreed time; - does not promise its customers more than we promise. ## What is not available - International zones (gTLD): there is no channel yet. - Emulation of other providers' HTTP APIs. Use our API with keys instead. About prices: [reseller price list](https://zrazu.com/en/docs/resellers-prices.md). A short description of the program is on [https://zrazu.com/resellers/](https://zrazu.com/resellers/). ## If it didn't work - **"The application is submitted by the organization's owner or administrator — they sign the contract."** Sign in as the owner or an administrator, or ask them to submit the form. - **"An application is already awaiting review".** One application is already submitted, you do not need another. Wait for the manager's email. - **"The organization is already a reseller".** Your organization is already in the program: go to "Reseller" → "EPP connection". - **"The reseller contract is closed".** No new application is needed: to resume working together, write to your manager via Support. - **"EDRPOU — 8 digits (company) or tax number — 10 digits (sole proprietor)".** Check the number: digits only, no letters. - **A phone or email error.** Fix the field: a phone has digits and may include "+", spaces and brackets; the email looks like name@example.com. - **A website error.** Enter an address like example.com.ua or leave the field empty. - **A zones error.** Tick at least one zone from the list, or "All". --- # EPP connection in the reseller cabinet URL: https://zrazu.com/en/docs/resellers-epp/ The "Reseller" → "EPP connection" section of the [cabinet](https://vse.zrazu.com/reseller/) is where your billing connects to ZRAZU. Logins, passwords, IP addresses, the certificate and safeguards are visible to and managed by the organization's owner, administrators and technicians. The password of a live login is set only by the owner or an administrator. The section appears after the contract. How to get one: [how to become a reseller](https://zrazu.com/en/docs/resellers-program.md). ## Addresses - **Sandbox:** `epp-test.zrazu.com`, port 1700. Test balance, no real money is charged. - **Live server:** `epp.zrazu.com`, port 700. The connection is protected by TLS 1.2 or newer. The limits on concurrent sessions and commands per minute are shown in the section itself. ## Step 1. Get a sandbox login You get the sandbox login yourself: one per reseller. 1. Find the "The epp-test sandbox" block. 2. Choose a login: 3–16 characters, Latin letters, digits, hyphen and underscore; the first must be a letter. 3. Enter the IP addresses your billing will connect from: 1 to 20, one per line or comma-separated. 4. Click "Get a sandbox login". 5. Set a password for the login right away (step 2). Your manager sets up the live login and the response profile after the sandbox check. ## Step 2. Set a password You set the password. We never see it and cannot show it, only reset it at your request. 1. In the "EPP logins" table find your login and click "Set password". 2. Enter the password twice or click "Generate". 3. If the password is generated, copy it into your billing module before you close the window: we cannot show it later. 4. Click "Save password". Requirements: 16–64 characters, Latin letters, digits and punctuation, no spaces; at least three of four kinds (lowercase, uppercase, digits, symbols); the login must not appear inside the password. 16 characters suit all modules, and the rfc profile cannot take more. The new password replaces the old one at once. A billing system you have not updated yet loses access to the login. Prepare the module settings first, then confirm. ## Step 3. IP addresses and certificate An IP allow list is required: a connection from an address that is not in the list is closed. Add the outgoing address of your billing server to every login: the "Configure" button in the logins table. You can add a public IPv4 or IPv6 address, or a network no wider than /24 (/64 for IPv6). A client certificate is optional. Create the key and the certificate on your side and upload only the certificate: the private key stays with you. The server checks the certificate fingerprint at sign-in. For the Hostmaster namespaces the certificate is required. Every change to addresses or the certificate closes the login's open sessions and is emailed to owners and administrators. ## Safeguards - **Mass actions.** If the number of transfer codes, NS changes and owner changes per hour or per day goes over the threshold, the next commands are not rejected: they wait for your confirmation in the "Awaiting confirmation" block at the top of the section. Confirming needs two-factor authentication; refusing is immediate. If you do not decide, the command is dropped after a few hours and your billing gets the outcome in poll. - **Login hijack guard.** An owner change under the contact lock, unlocking or a transfer code within 72 hours of an owner change needs your confirmation. - **Daily summary.** How many transfer codes, NS changes and owner changes were done during the day. - **"Revoke access".** A button in the section: all sessions close and the passwords of all logins are replaced. Billing stops working with ZRAZU until you set new passwords. IP addresses and certificates stay. ## EPP manual and portfolio transfer - [EPP manual](https://vse.zrazu.com/reseller/manual/): the full partner manual with commands, response codes, the sandbox and security. It is in Ukrainian, and the cabinet shows it inside the page frame. The same roles see it as the "EPP connection" section. - [Portfolio transfer](https://vse.zrazu.com/reseller/import/): domains from another provider are moved in a batch of "domain ; code" at the wholesale price. A domain cannot be moved without its code. WHMCS has ready-made modules: [modules for WHMCS](https://zrazu.com/en/docs/resellers-whmcs.md). ## If it didn't work - **The connection is closed with code 2501.** Your server's address is not in the login's allow list. Add it under "Configure". - **"The login … is already taken — choose another name".** Choose a different login. - **"You already have a sandbox login — a reseller gets only one".** Set a password for the existing login or change its IP addresses. - **"Enter 1 to 20 public IP addresses".** Private and invalid addresses are not accepted. - **"The passwords do not match" or "The password must be 16 to 64 characters long".** Check both fields. - **"File not accepted: it is too large for a certificate".** Upload the certificate itself (BEGIN CERTIFICATE), not a chain or an archive. - **The section does not open or is empty.** Only the owner, administrators and technicians of a reseller organization see it. If you are a reseller and have no access, write to your manager. --- # Reseller price list in the cabinet URL: https://zrazu.com/en/docs/resellers-prices/ The reseller price list shows your wholesale price next to the ZRAZU storefront retail price, separately for domains and for SSL. It is the same price the cart in the cabinet and your module use. We do not quote amounts in this documentation: they depend on the zone, the volume and your contract. General storefront prices: [https://zrazu.com/prices/](https://zrazu.com/prices/). ## Where to find it [Cabinet](https://vse.zrazu.com/reseller/prices/) → "Reseller" → "Price list". The price list is visible to the owner, administrators and technicians of a reseller organization. From the "EPP connection" section, the "Open the price list" button leads here. The list is always "as of today": when a zone or certificate is added or removed, or a price changes, the list updates itself. We give 30 days' notice of a price list change. The exceptions are changes to the registry price and the exchange rate: they apply on the day they take effect. ## The "Domains" tab 1. Open the "Domains" tab. 2. If there are many zones, use the "Find a zone" field. 3. For every zone and operation there are two columns: "Wholesale" (your price) and "Retail" (the storefront price for a guest). How to read the table: - The price is per 1 year. Several years of registration or renewal cost a multiple. Transfer and restore are always for 1 year. - A dash "—" means there is no such operation in this zone. The mark "transfer only" means the zone can only be transferred in. - Retail is shown with or without VAT, as in your contract. - If your contract has individual terms, a note under the price list reads "Wholesale follows your individual price list". ### Currency The wholesale price list is in US dollars. The balance is charged in hryvnia at the PrivatBank rate (non-cash, sale) on the day of the operation. The rate and the date it applies to are shown above the table. The cabinet shows the hryvnia amount under the dollar one. While there is no fresh rate, the hryvnia is not shown, only the dollar. The amount is reserved when a command is accepted. If the registry refuses, the reserve returns to the balance. ## The "SSL certificates" tab Certificates by brand: wholesale, retail, the time to issue and validate, and the type (one domain, wildcard, or several names in one certificate). Prices are in hryvnia per 1 year. They are the same as in the cabinet and in the [modules for WHMCS](https://zrazu.com/en/docs/resellers-whmcs.md). If SSL is not enabled in your contract yet, the wholesale prices apply once it is, and until then certificates are bought at the retail price. To enable it, write to your manager. ## If it didn't work - **The page says the price list is visible to the owner, administrators and technicians.** Your role has no access. Ask a colleague with such a role, or your manager. - **"No such zone in the price list".** The zone is not in your price list yet or is misspelled. You can omit the leading dot. - **"No zones in the price list yet" or "No certificates in the price list yet".** Write to your manager. - **No hryvnia amounts.** There is no fresh dollar rate yet. The hryvnia appears as soon as it does. --- # ZRAZU modules for WHMCS URL: https://zrazu.com/en/docs/resellers-whmcs/ We have two ready-made modules for WHMCS. "ZRAZU Domains" sells domains over EPP (a registrar module). "ZRAZU SSL" sells certificates over the API (a server module). You can install them together or one at a time. The modules are available to resellers after the contract: [how to become a reseller](https://zrazu.com/en/docs/resellers-program.md). Everything below is done in the [“Reseller”](https://vse.zrazu.com/reseller/) section of the cabinet, visible to the owner, administrators and technicians. ## What you will need - An active reseller contract and an EPP sandbox login: [EPP connection](https://zrazu.com/en/docs/resellers-epp.md). - Access to the WHMCS server and its outgoing IP address (it must be added to the login). - For SSL: SSL in your contract. If it is not enabled yet, write to your manager. ## Step 1. Download the archive 1. In the "Reseller" section find the "WHMCS modules" block. 2. Choose the archive for your version: there is a package for WHMCS 8 and newer (PHP 8.1+) and a package for WHMCS 7.4–8.x on PHP 7.0–8.3. 3. Click "Download" and compare the checksum with the one shown next to it. The archive is closed: do not publish it or pass it to third parties. It contains both modules, their READMEs, the changelog and the EPP manual. Every download is recorded in the organization log. ## Step 2. The "ZRAZU Domains" module 1. Unpack the archive and copy the contents of the `zrazu-domains/` folder into the WHMCS root. 2. In WHMCS open System → Settings → Domain Registrars and activate "ZRAZU Domains". 3. Enter the EPP address, login and password, and turn on test mode. Take the address and login from the "EPP connection" section. 4. Test registration, renewal, transfer and deletion. The sandbox answers these commands with code 1001, and the outcome arrives in poll in about 30 seconds. 5. When the test passes, in WHMCS under the domain pricing page choose "ZRAZU Domains" for the zones you need and switch the module to the live login that your manager sets up. ## Step 3. The "ZRAZU SSL" module Test it in the sandbox first. It has the same rights and answers as live mode, but the money is test money and the certificates come from an untrusted test authority. 1. Copy the contents of the `zrazu-ssl/` folder into the WHMCS root, together with the hook `includes/hooks/zrazussl.php`. 2. In the "Reseller" section find the "Test key — SSL sandbox" block. Enter your WHMCS server addresses and click "Test key". Copy the key right away: we will not show it again. 3. In WHMCS: Servers → Add New Server, type "ZRAZU SSL". Enter the sandbox API address (shown in the "Integration guide" block) and put the key in the Password field. Click Test Connection. 4. Create a product of type Other, module "ZRAZU SSL", payment mode "Under the contract". 5. Run the checks from the module README, including the failure trigger names. ## Step 4. The live key for SSL 1. In the "SSL under the contract and the WHMCS module" block enter your WHMCS server addresses: one per line, public IPv4 or IPv6, a network no wider than /24 and /64. 2. Optionally give the key a name and set a daily spending limit in hryvnia: how much the module may spend from the balance per day. Above it orders are refused with a reason. Change the limit with a new key. 3. Click "Issue the “WHMCS module (SSL)” key". 4. Copy the key and paste it into the module settings, then click "I have copied the key". We will not show it again. All keys are later listed under "API keys". 5. In WHMCS add a second "ZRAZU SSL" server with the live API address and this key. The key lives for a limited time, works only from your WHMCS server addresses, and issuing a certificate needs a second factor. The validity period is shown in the cabinet. ## Other billing systems Ready-made modules exist for WHMCS. Any other billing connects over EPP by the manual: [EPP connection](https://zrazu.com/en/docs/resellers-epp.md). ## If it didn't work - **The connection is closed with code 2501.** The outgoing address of your WHMCS server is not in the EPP login's allow list. Add it under "Configure" next to the login. - **The live address does not accept the test key.** The test key works only at the sandbox address. For live mode, issue a live key. - **You lost the key.** It cannot be shown a second time. Issue a new one and replace it in the module settings. - **An order was refused because of the limit.** The key's daily spending limit is exceeded. Issue a new key with a different limit. - **The cabinet says "The archive is not built yet — write to your manager".** Write to your manager via Support. - **Any other question about the module.** Check the README in the archive, and if the answer is not there, write to Support. --- # Web studio cabinet URL: https://zrazu.com/en/docs/resellers-studio/ The web studio program gives you one cabinet for the domains of all your clients: a tier by domain count, a list of clients, a monthly statement with a breakdown, and domain transfers in waves. Joining is free, with no contract or advance. This is not the same as the reseller program. A reseller sells domains from its own billing, while a studio buys in its own cabinet for its clients. For resellers: [how to become a reseller](https://zrazu.com/en/docs/resellers-program.md). The studio terms are also on [https://zrazu.com/studios/](https://zrazu.com/studios/). ## What a studio gets - An inventory of all your clients' domains: expiry dates, name servers, email, SSL, and what can be transferred right now. - DNS hosting for any of your zones, even if the domain is registered with another registrar. - Monitoring of the domains you already hold with us, at no extra cost. - A discount on Ukrainian zones by the number of domains under management. International zones (gTLD) get no discount: they carry a fixed markup over the registry price. What is not included: cash payouts for clients, hosting (only domains, DNS and SSL), and discounts beyond the published grid. ## How to join The owner or an administrator of the organization joins. 1. Open [studio mode](https://vse.zrazu.com/agency/) in the cabinet. It is visible to organization members with domain access. You can also find "Studio mode" in the cabinet command search. 2. Read the "Terms" and click "Join the program". 3. After joining, a "Studio" item appears in the menu. ## Studio cabinet sections | Section | What it holds | | --- | --- | | Overview | How many domains you have at ZRAZU, your tier, how many remain to the next one, the tier ladder | | Clients | Studio clients, their domains, the nearest renewal, assigning domains to clients | | Transfers | Transfer waves and the state of each | | Referrals | Your referral link and the list of people who came through it | | Prices | First-year prices by tier: the storefront price, then your price | | Statement | Payments for the month broken down by client | | Terms | The program terms and how to leave | ## Tier The tier depends on the number of domains under management (domains registered at ZRAZU in the studio's organization), not on turnover. The tiers are "Base", "Studio", "Studio+" and "Partner". The thresholds and your current tier are shown in "Overview". While a database transfer is in progress, a tier in advance by the transfer plan can be agreed. The size of the discount is on [https://zrazu.com/studios/](https://zrazu.com/studios/). The program terms there and in the cabinet's "Terms" section are marked as preliminary. ## Clients and domains 1. Open "Clients", click "Add a client" and enter the client's name. 2. In the "Assign domains to a client" block enter the domains, one per line, choose the client and click "Assign". To unassign, choose "no client". 3. The client opens on its own page with a list of domains: expiry date and auto-renewal. Clients and assignments are changed by the owner or an administrator. The client stays the domain owner (registrant), the studio manages the account and pays. To hand a domain over to the client's own account, change the owner in the "Owner" tab of the domain card. An owner change takes a 72-hour pause and emails all contacts. We send your clients no marketing emails and offer them no direct terms. Service emails to the domain owner and contacts (a transfer code, a change of owner, contacts or DNS, the last warning before deletion) always go out: that protects the domain from theft. ## Prices The "Prices" section shows first-year registration for your tier next to the storefront price. This is what the cart will actually charge. Prices are in hryvnia, with or without VAT: you choose in the cart. ## Monthly statement 1. Open "Statement" and enter the month as 2026-09. 2. You will see the paid items by client: amount without VAT, VAT and the total. 3. To re-invoice your clients, click "Download CSV for re-invoicing". The statement is visible to roles with billing access: accountant, admin or owner. ## Moving your database 1. In "Transfer" check the domains: which can be moved now, which are blocked and why. 2. Build a cart with transfer codes and start the transfers. 3. In "Transfers" follow the waves: a wave is one transfer order. Partial success is normal: a refusal returns the money to your balance, and the wave goes on. DNS and registration are moved separately, so sites and email keep working while they wait for the transfer code. We switch nothing without you. ## Referral link "Referrals" holds your link for clients who buy by themselves. Whoever signs up with it appears in the list with a date, without a name: they are their own client until they invite you to their team. There are no cash payouts for invitees. ## How to leave the program We email the transfer code of each domain to its owner, not on screen: that is how we protect against hijacking. Bulk codes for all domains go through Support, after checking that the request comes from the organization owner. The "Terms" section has a "Write to support" button. ## If it didn't work - **There is no "Studio" item in the menu.** You have not joined the program yet, or your role has no domain access. The owner or an administrator can join. - **You cannot add a client or assign domains.** Only the owner or an administrator can. - **"your role does not allow this action".** Ask the organization's owner or an administrator. - **The statement does not open.** It is visible to the accountant, administrators and the owner. - **"Month format: 2026-09".** Enter the year, a hyphen and a two-digit month. - **The "Prices" section says there are too many requests.** Wait a minute and refresh the page.