Webhooks
Make certificate lifecycle events part of your application.
Certificate lifecycle events as signed JSON your application can consume. Six event types. HMAC-SHA256. Retries with history. A test delivery. No invented hostname events.
Event types that exist
certificate.order.createdcertificate.validation_requiredcertificate.issuedcertificate.renewedcertificate.renewal_failedcertificate.revoked
Real payload shape
{
"id": "01JDEMODEMOEVENT0001",
"type": "certificate.issued",
"created_at": "2026-09-20T14:03:12+00:00",
"data": {
"certificate_id": "01JDEMOCERT0000000001",
"order_id": "01JDEMOORDER000000001"
}
}Headers: X-Sslcertificates-Signature: sha256= hex HMAC of the raw body, X-Sslcertificates-Event, X-Sslcertificates-Delivery. Secret is shown once. Localhost and private URLs are rejected.
Retries, test delivery, rotation, consumers
Failed deliveries retry every five minutes, up to eight attempts, backoff capped at 60 minutes. History stores attempt, http_status and a 500-character excerpt. POST /api/v1/webhooks/{id}/test sends a signed test. Rotate by creating a new endpoint and disabling the old one. Consumers must key on event id.
| Event | Attempt | Status | HTTP |
|---|---|---|---|
| certificate.issued | 1 | delivered | 200 |
| certificate.renewal_failed | 3 | failed · next_retry_at set | 502 |
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
Which events exist?
certificate.order.created, certificate.validation_required, certificate.issued, certificate.renewed, certificate.renewal_failed, certificate.revoked.
How do I verify a delivery?
Compute HMAC-SHA256 of the raw body with the endpoint secret. Compare to X-Sslcertificates-Signature (sha256=hex). Reject localhost and private URLs — the dispatcher already does.
How many retries?
Failed deliveries retry up to 8 attempts, every five minutes, with backoff up to 60 minutes. History stores attempt, status and a 500-character response excerpt.
Can I send a test event?
POST /api/v1/webhooks/{id}/test or use the dashboard test action. The secret is shown once at creation.
How should consumers be idempotent?
Key on the event id (ULID). Re-deliveries can happen. Do not issue a second deploy because you saw issued twice.
Is there hostname.created?
No. Poll custom-hostnames and use certificate events.
What headers are sent?
Content-Type: application/json, X-Sslcertificates-Signature, X-Sslcertificates-Event, X-Sslcertificates-Delivery.
Drive tenant state from signed events.
Create an endpoint, verify HMAC, and treat event id as the idempotency key.