Reissue, revoke and renew

Reissue and revoke

POST /api/v1/ssls/reissue

Re-issues an active certificate with a new key pair or a new approver. Free on most packages. The validity period is not extended.

When you need this

• The private key was lost or compromised.
• The server is being rebuilt and the key cannot be recovered.
• The approver e-mail address needs changing.

Request — let us generate a new key

{
  "domainName": "apiname.com"
}

Request — bring your own new CSR

{
  "domainName": "apiname.com",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
  "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
  "approverMail": "webmaster@apiname.com"
}

Response — 200, when you omitted the CSR

{
  "success": true,
  "message": "Reissue request submitted",
  "certificateId": "5e8c2a71-4b93-4f06-ae25-1d7f9c3b8042",
  "status": "WaitingForValidation",
  "dcvDetails": "{\"MD5\":\"...\",\"SHA1\":\"...\",\"UniqueValue\":\"...\"}",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzEL...\n-----END CERTIFICATE REQUEST-----",
  "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhki...\n-----END PRIVATE KEY-----"
}

Save csr and privateKey from this response immediately

This is the only time these are returned. There is no way to fetch the generated private key again, and the reissued certificate cannot be installed without it. If you lose it you must reissue again.

If you send your own csr, these two fields come back null — the key stays with you, which is the safer option.

After reissuing you go through validation again: publish the new dcvDetails record or have the approver click the new e-mail, then poll check-status.

Errors

Code	Meaning and fix
Ssl:10026	No certificate for this domain.
Ssl:10006	Reissue is not supported for this certificate.
Ssl:10008	The certificate must be Active. You cannot reissue one that is still validating.
Ssl:10055	The subscription has ended. Reissue is not possible — buy a new certificate.
Ssl:10075	This package is managed by our technical team. Open a support ticket.
Ssl:10007	The CA failed to process the reissue. Retry, or open a ticket.
Ssl:10004 / Ssl:10040	Your supplied CSR is invalid or its name does not match.

DELETE /api/v1/ssls/revoke

Revokes the certificate. Its status becomes Cancelled.

Request

{
  "domainName": "apiname.com"
}

This is not a refund, and it is not reversible

Revoking a configured certificate does not return the fee. The only automatic refund is letting the 7-day configuration window lapse on a refundable package.

Once revoked, the certificate is permanently distrusted by browsers. You cannot un-revoke it — a new purchase is required. Only revoke when the private key is known to be compromised.

Errors

Code	Meaning and fix
Ssl:10026	No certificate for this domain.
Ssl:10027	The status does not allow revoking — already cancelled, or not yet configured.
Ssl:10049	The revoke failed. Note: this code is shared with a CA connectivity error — read the message to tell which.
Ssl:10075	Package managed by our technical team. Open a support ticket.

Renewal

There is no renewal endpoint. Renewal is a fresh purchase cycle inside the renewal window:

1. GET /api/v1/ssls/certificate — read subscription.expiresAt.
2. Within 30 days of that date, POST /api/v1/ssls/initialize with the same domain. You are charged for a new one-year subscription.
3. PUT /api/v1/ssls/configure — the new year begins here, not at the old expiry.
4. The old certificate’s status becomes Renewed. It stays technically valid until its own expiry, so there is no gap.

Do not renew early

Remaining days are not carried over. Renewing 30 days before expiry and configuring immediately loses those 30 days. Renew within the window but close to expiry — around 7 to 14 days before is a good balance between safety and value.

Code	Meaning and fix
Ssl:10057	Too early. The message tells you the date renewal opens.
Ssl:10058	Already renewed — the renewal is in your certificate list.
Ssl:10059	Not renewable. Only configured, non-cancelled certificates can be renewed.