Developer-first TLS automation
Automate TLS certificates with one API.
Issue, validate, renew and deploy certificates across providers and infrastructure — without building certificate lifecycle automation yourself.
curl https://sslcertificates.io/api/v1/certificates \
-H "Authorization: Bearer $SSL_CERTIFICATES_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domains":["example.com"],"validation":"dns-01"}'Certificate lifetimes are getting shorter. Manual workflows aren't.
The CA/Browser Forum Baseline Requirements cap publicly trusted TLS subscriber certificates at 200 days from 15 March 2026, 100 days from 15 March 2027, and 47 days from 15 March 2029. Domain and IP validation data reuse shrinks on those dates — to 10 days in 2029. Certificates already issued keep their notAfter. New ones do not get the old 398-day habit. Calendar reminders and panel click-paths were barely keeping up once a year. They will not keep up several times a year, on every name, with a verify step after every install.
Certificate automation usually breaks after issuance
Custom domains become infrastructure projects
A hostname field hides ownership proof, DNS drift, ACME limits and renewal. SaaS teams inherit all of it.
Renewal is useless if deployment still fails
Issued, uploaded, bound, reloaded, handshake verified, rollback ready. Stop at issued and the old leaf stays live.
Every customer environment is different
Plesk, cloud, a VPN UI, a vendor PEM. PSA dates do not isolate tenants or install replacements.
You can't prevent expiry for certificates you can't see
The outage name is often missing from the CA portal. Inventory first, then automate what you terminate.
Choose the operating manual that matches the work
SaaS Platforms
Customers type their own hostname. You inherit ownership proof, DNS failures, issuance, renewal and support.
Hosting Providers
A certificate in the panel store is not a live HTTPS site. Deploy, bind, reload, verify, then keep a rollback.
MSPs
PSA reminders track a date. They do not isolate customers, deploy a replacement, or tell you which client will page you Friday night.
Agencies
Launching the site made you the default owner of DNS and TLS. Renewals should not reopen the project.
Developers & Platform Teams
Every service that speaks ACME owns retries, rate limits and inventory. Call lifecycle primitives instead.
Enterprise IT & Security
Spreadsheets list the certificates you remember. Outages come from the ones nobody listed.
The certificate lifecycle is more than a CA response
Product overview — one control plane from request to verified deployment.
One lifecycle. The pieces work together.
Each card is one outcome, one proof point, and one page. This is not a feature adjective strip.
Certificate API
Issue, validate, download, renew and revoke through one REST contract.
POST /api/v1/certificates returns 202 with an order id. Every response carries X-Request-Id.
Custom Hostnames
Customer-owned names get an ownership token and a CNAME target before issuance.
POST /api/v1/custom-hostnames returns ownership_token (own_…) and cname_target.
Automated Renewals
Active certificates with auto-renew on are scheduled before expiry.
The scheduler selects next_renewal_at (default 30 days before notAfter) and emits certificate.renewed or certificate.renewal_failed.
Deployment Automation
A connected target can install the replacement and keep a rollback copy.
SSH deploys record the expected SHA-256 fingerprint and can restore the previous fullchain.
Inventory & Monitoring
See what expires next and which orders already need a person.
The dashboard lists status, notAfter, auto-renew and Action Required for the current organization.
Multi-CA
Pick a provider on the order. The request shape stays the same.
POST /certificates accepts provider. Silent failover after a challenge is published is not performed.
SaaS custom domains, without building certificate infrastructure
When a customer types app.customer.com, call POST /api/v1/custom-hostnames. You get an ownership_token and a cname_target. Issue with POST /api/v1/certificates. Deliver the PEM to the edge you already run — we are not asking you to move traffic onto a CDN you did not choose. Webhooks fire on issued, renewed and renewal_failed. That is the white-label path; the long form is the SaaS solution.
Works with the tools you already use
Connect certificate authorities, DNS, hosting panels and cloud accounts a customer uses for issuance, validation or deploy. Third-party names identify products you can connect — not partnerships. Internal billing and analytics tools are not listed here.
See expiry and failed renewals before customers do
Demo data only — a fictional organization, no customer hostnames.
| Hostname | Status | Not after | Attention |
|---|---|---|---|
| shop.demo-merchant.test | Active | 2026-10-04 | Expiring · 14 days |
| api.demo-merchant.test | Renewal failed | 2026-09-28 | DNS TXT missing |
| vpn.demo-internal.test | Imported | 2026-10-12 | Action Required · no connector |
| pay.demo-merchant.test | Active | 2027-02-02 | Verified handshake |
Developer experience
Official PHP, TypeScript, Python and Go clients post to the same /certificates resource. HMAC-signed webhooks, idempotency keys, and X-Request-Id on every response. OpenAPI is public. Test mode first.
Pricing preview
Let’s Encrypt has no CA fee. Commercial CA charges appear on invoices only after you connect that authority and issue through it.
10 domains, Test issuance, 1 API key.
100 domains and DNS automation when a provider account is connected.
1,000 domains, priority support, forced renewals, MFA and passkeys.
Resources
Automate your first certificate lifecycle.
Create an account, issue a Test certificate with official Let’s Encrypt Staging, and decide later whether the next name is a custom hostname, a hosting deploy, or an imported exception.