Create a Let's Encrypt SSL certificate

POST/v1/ssl_certificates/letsencrypt

Send a POST request to the /v1/ssl_certificates/letsencrypt endpoint to issue a Let's Encrypt certificate for one of your DNS domains.

Ownership of the domain is proven with a DNS-01 challenge, so the domain referenced by domain_id must be delegated to our nameservers before a certificate can be requested - see GET /v1/dns/domains/delegation_data for the nameservers to delegate it to. The _acme-challenge TXT records are created in that domain for you, so no DNS changes are required on your side.

The certificate is created with the pending_validation status and returned immediately; it is then issued in the background. Poll GET /v1/ssl_certificates/letsencrypt/{id} until status becomes ready. Until then issuer, subject, domain_names and expires_at are empty.

Issued certificates are renewed automatically, starting 30 days before they expire.

The private key is supplied by you and is never returned by the API.

Authorization

bearerAuth
AuthorizationBearer <token>

In: header

Request Body

FieldDetails
name
string

Certificate name. Letters, digits, - and _, up to 255 characters

domain_id
string

Identifier of the DNS domain to issue the certificate for, as returned by GET /v1/dns/domains. The domain must be delegated to our nameservers

private_key
string

PEM-encoded private key to issue the certificate for. RSA and EC keys are supported. The key is stored securely and is never returned by the API

domain_names?
array<string>

Additional domain names to cover, each either the domain itself or a subdomain of it. Wildcards such as *.example.com are supported. The apex domain is always included, so omit this to get a certificate for the domain alone

labels?
object

Key/value pairs to attach to the certificate

Response Body

application/json

application/json

application/json

curl -X POST "https://example.com/v1/ssl_certificates/letsencrypt" \  -H "Content-Type: application/json" \  -d '{    "name": "name2253",    "domain_id": "l9av8VdG",    "private_key": "-----BEGIN RSA PRIVATE KEY-----\\nMIICXAIBAAKBgQDLvsF8PqyM1bQkpmbNFiEVIOQOk7BawaOSFhSQmV2rPHmN9Yd6\\n1QJ85j8puVUO31T43rzO2c7kuuVjPJ7UWZJv8j/XT3LBh8QYRUyPNvlDd78mnjXs\\nVSfjhVA6guk3CT9spfYgxobO7ZrjT5ebt5ejImK94wmzomMJa+cguS28/QIDAQAB\\nAoGAJ7ZotDTrIRBOao5cn0De9eVRTl4PE8GGhmTzYTPjhArnjnn7DEAUmg+u5A0R\\nvTJet5uCpbbiksazC2K3eqBy4DIHeHFvx1ZsxdCbTzoUOp6jY4Qm51/RzDzULAQu\\nP7TnAQQNB1QcB9otxPYU+5PynoO2SybZa09Bcdh4Zb0iYikCQQDnpkCvWpw9lXtB\\nvsOfZUXVxcjxUHcUewBCyYniBo92iK07XzHIrr0q22Zv6Pnv4pIzJb6vsATM1FZd\\nz/448cf7AkEA4SmXaKhDToI35qH1plbFvekhPecH2yApJjhvINwp5REiCRxWQjIX\\nzw+B7U+bEV97qilrekhx21qm1PgwDs0lZwJAXOlT3IFtVU4VZ+NJty75eaqg1BlA\\nCdjj2+XWBfA3roVXZg7ieumLOhtR1OUPCmZH2Xf0Kadh5X3tPidkghaH7QJAD9P7\\np8jESn2O7nCOMy5AYlREGPTnsXi2S9CFx1qSu16T9O4ABlE9KToe2Q7SiMsch164\\nBnWXQ2NA/RGhVzkGmwJBAJGQiKiPvHhfERAoEbJssTXY5/H/PRd/XDyDPLpd71W+\\nD65hrF4WTR39HiD3AOdrr4lpj9TXhDGe49nBfz5XOUs=\\n-----END RSA PRIVATE KEY-----\\n",    "domain_names": [      "www.example-2561.com",      "*.example-2561.com"    ],    "labels": {      "environment": "production",      "service": "my-web-app",      "example.com/project": "my-project",      "example.com/owner": "my-team"    }  }'
{  "id": "8mep2bMy",  "name": "name2253",  "type": "letsencrypt",  "status": "pending_validation",  "issuer": null,  "subject": null,  "subdomains": [    "example-2561.com",    "www.example-2561.com",    "*.example-2561.com"  ],  "domain_names": [],  "labels": {    "environment": "production",    "service": "my-web-app",    "example.com/project": "my-project",    "example.com/owner": "my-team"  },  "expires_at": null,  "created_at": "2025-12-31T00:00:00Z",  "updated_at": "2025-12-31T00:00:00Z"}