Free certificates,
built into your workflow.

1. 01

   Create a certificate session

   Submit a domain, a validation method, and confirmation that you accept the Let's Encrypt Subscriber Agreement. Save the opaque session_id returned by the API.

   cURLPOST /ssl/gen

   curl --request POST https://your-host/ssl/gen \
     --header "Content-Type: application/json" \
     --data '{
       "domain": "example.com",
       "verification": "dns",
       "email": "you@example.com",
       "accept_terms": true
     }'

   201 Created

   {
     "session_id": "opaque-random-session-id",
     "domain": "example.com",
     "verification": "dns-01",
     "status": "challenge_ready",
     "challenge_url": "/ssl/gen/opaque-random-session-id/challenge/",
     "expires_at": "2026-09-05T12:00:00+00:00"
   }

2. 02

   Get and publish the challenge

   Request the session challenge. For DNS, add the returned TXT record. For HTTP, serve the returned content exactly at the returned path over public port 80.

   cURLGET challenge

   curl https://your-host/ssl/gen/$SESSION_ID/challenge/

   DNS-01 response

   {
     "verification": "dns-01",
     "record": {
       "type": "TXT",
       "name": "_acme-challenge.example.com",
       "value": "challenge-value"
     }
   }

   Optional preflight: call POST /ssl/gen/$SESSION_ID/challenge/verify/ to run an advisory check. Let's Encrypt remains the authority that validates the proof. HTTP preflight is disabled by default.

3. 03

   Ask Let's Encrypt to issue

   Once the record or file is publicly reachable, issue the certificate. The API answers the ACME challenge, waits for issuance, and returns a download URL when the order is complete.

   cURLPOST certificate

   curl --request POST https://your-host/ssl/gen/$SESSION_ID/cert

   200 OK

   {
     "session_id": "opaque-random-session-id",
     "status": "issued",
     "download_url": "/ssl/download/opaque-random-session-id/"
   }

   Still processing? A 202 Accepted response includes status: "pending_ca". Retry the same certificate endpoint; do not create a new order.

4. 04

   Download and protect the bundle

   Download the archive before the session expires. Most web servers use fullchain.pem and private_key.pem; secure the private key immediately after download.

   cURLGET archive

   curl --location \
     --output example.com-certificate.zip \
     https://your-host/ssl/download/$SESSION_ID/

const baseUrl = "https://your-host";

const sessionResponse = await fetch(`${baseUrl}/ssl/gen`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    domain: "example.com",
    verification: "dns",
    accept_terms: true
  })
});

if (!sessionResponse.ok) throw new Error("Session failed");
const session = await sessionResponse.json();

const challenge = await fetch(`${baseUrl}${session.challenge_url}`)
  .then(response => response.json());

console.log(challenge.record);

import requests

base_url = "https://your-host"
session_response = requests.post(
    f"{base_url}/ssl/gen",
    json={
        "domain": "example.com",
        "verification": "dns",
        "accept_terms": True,
    },
)
session_response.raise_for_status()
session = session_response.json()

challenge = requests.get(
    f"{base_url}/ssl/gen/{session['session_id']}/challenge/"
).json()

print(challenge["record"])

After your DNS provider or web server publishes the proof, call the certificate endpoint shown in the quick start. Keep the session ID out of logs, tickets, browser URLs, and untrusted build output.