Certificates

A zone certificate is a TLS certificate for names in one of your zones. Dinio’s edge serves it by SNI. Like everything else in a zone, it belongs to the zone: the zone key, the zone’s Owner and its Administrators can manage it. See DNS hosting.

interface Certificate {
  uuid: string;
  zone_id: string;
  source: 'Manual' | 'Acme';   // uploaded, or issued by Dinio for a redirect
  is_default: boolean;         // always false for a zone certificate
  names: string[];             // SAN DNS names, lowercase; wildcards as "*.example.com"
  subject: string;
  issuer: string;
  serial: string;
  fingerprint_sha256: string;
  valid_from: number;          // Unix seconds
  valid_to: number;
  expired: boolean;            // valid_to had passed when the response was made
  key_type: string;            // e.g. "EC P-256", "RSA 2048", "Ed25519"
  chain_length: number;        // leaf plus intermediates
  created_at: number;
  updated_at: number;
}

The details are read from the certificate itself. The private key is never returned.

One certificate per name. A name can be covered by only one certificate: an upload whose names overlap an existing certificate is refused — renew that one instead. A name matches a certificate exactly or through a one-label wildcard (*.example.com covers www.example.com, not a.b.example.com).

source: "Acme" marks a certificate Dinio issued for a redirect with tls: "Auto". You can read it, but not renew or delete it: those return 409 MANAGED_CERTIFICATE. Change the redirect’s tls instead.

List certificates

GET /api/v1/certificates

Certificates of every zone you can access; with a zone key, of its zone.

Query
zone_id	Only this zone.
name	Only certificates that cover this host name. Returns every match at once, without pagination.
page, per_page	Pagination, per_page default 50, up to 200.

curl -H "Authorization: Bearer $DINIO_API_KEY" \
  "https://api-dinio.bitelex.com/api/v1/certificates?name=www.example.com"

Get a certificate

GET /api/v1/certificates/:uuid

Upload a certificate

POST /api/v1/certificates

Field	Type
zone_id	uuid	The zone the names belong to.
chain_pem	string	PEM: the leaf certificate first, then intermediates. Up to 64 KiB.
key_pem	string	PEM private key of the leaf. Up to 16 KiB.

jq -n --arg zone "$ZONE_ID" --rawfile chain fullchain.pem --rawfile key privkey.pem \
  '{zone_id: $zone, chain_pem: $chain, key_pem: $key}' |
curl -X POST -H "Authorization: Bearer $DINIO_API_KEY" -H "Content-Type: application/json" \
  -d @- https://api-dinio.bitelex.com/api/v1/certificates

Returns 201. Every SAN name must be served by the zone — inside it, not in a more specific zone, not delegated away — and none may be the name of a redirect with tls: "Auto" (switch the redirect to Manual first). These and an overlap with another certificate are 409 CONFLICT. The certificate itself is checked too, and every problem found is returned as 422 VALIDATION: an unreadable chain or an encrypted key, a key that doesn’t belong to the leaf, a chain out of order, an expired leaf, an unsupported key type (RSA, EC P-256/P-384 and Ed25519 are accepted), or no SAN DNS names.

Renew a certificate

PUT /api/v1/certificates/:uuid

Replaces the chain and key under the same uuid, with the same fields and rules as an upload (without zone_id — the zone stays). Use it for a renewed certificate.

Delete a certificate

DELETE /api/v1/certificates/:uuid

Dinio’s edge stops serving it; requests for its names get another matching certificate, or the platform’s default one. Nothing is issued in its place.