How can I renew Site SSL/TLS certificate via API

[luckykenlin]

Hi, there

Is there an api I can use to renew site’s SSL?

We have more than hundreds sites hosted by netlify.

Currently, part of site’s SSL are not auto-renew. We need to go dashboard domain management to renew the ssl.

I want to implement this feature to our backoffice So every one can renew it through there.

Thanks.

[dig]

@luckykenlin

I want to implement this feature to our backoffice So every one can renew it through there.

Better option is to figure out why SSL certificates are not auto-renewing for some sites @luckykenlin.

[luckykenlin]

I have no idea. I have checked DNS records are all correct, Or I have create CAA record ? it will help renewal process?

[dig]

I don’t know any domain(s) on which auto-renew has failed so I can’t offer any specifics. Do you see error messages that have resulted from failed SSL renewal?

[luckykenlin]

Faraday::SSLError: SSL_connect returned=1 errno=0 peeraddr=172.65.32.248:443 state=error: unexpected eof while reading

The error message show like above. I have check all dns are verified.

Updated: I just go to the dashboard and click renew button. after few seconds the SSL renewed.

Because we have hundreds site. any ssl expire notification I can implement before I solve this issue. We can’t check every site manually cause that are many.

[dig]

@luckykenlin

172.65.32.248

That is a Cloudflare IP address. This suggests you are proxying through Cloudflare which is not recommended or supported.

[Support Guide] What problems could occur when using Cloudflare in front of Netlify?

Last reviewed by Netlify Support - August, 2023 Note: We recommend not using both Cloudflare’s CDN (“Accelerate and Protect”, the orange cloud in their UI) and Netlify for the same site at the same time. Why? Read on! Netlify’s web service is not designed to work optimally with another CDN “in front of” our CDN. Proxying to our service is in general not supported and we advise you not to do it for best hosting results. Cloudflare has made similar statements that it doesn’t recommend this usa…

[luckykenlin]

The domain is nothing related with cloudflare, just hosted by godaddy. Could you explain how you see its proxying through cloudflare?

[dig]

@luckykenlin

The domain is nothing related with cloudflare, just hosted by godaddy.

Which you don’t appear to want to share. If you shared your domain it would enable to provision of more accurate answers rather than guesswork. But if you don’t want to share the domain, that’s fine.

@luckykenlin

Could you explain how you see its proxying through cloudflare?

I’ve already explained this.

In the error message you provided (below) there is an IP address.

@luckykenlin

Faraday::SSLError: SSL_connect returned=1 errno=0 peeraddr=172.65.32.248:443 state=error: unexpected eof while reading

This IP address is a Cloudflare IP address.

$ whois 172.65.32.248
NetRange:       172.64.0.0 - 172.71.255.255
CIDR:           172.64.0.0/13
NetName:        CLOUDFLARENET
NetHandle:      NET-172-64-0-0-1
Parent:         NET172 (NET-172-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       AS13335
Organization:   Cloudflare, Inc. (CLOUD14)
RegDate:        2015-02-25
Updated:        2021-05-26

So if you are not using Cloudflare directly on the domain it is likely you are using another service that uses Cloudflare’s platform. This in turn is causing the issues you see with SSL provisioning.

@luckykenlin

I want to implement this feature to our backoffice So every one can renew it through there.

This is not the answer. The answer is to ensure the setup you have for your domains works.