ZeroSSL

Free, publicly trusted SSL/TLS certificates from ZeroSSL (a Certificate Authority operated by Sectigo) — API docs: https://zerossl.com/documentation/api/

The API is REST over HTTPS on https://api.zerossl.com, authenticated with an access_key query parameter on every request — including POSTs, whose bodies carry only business parameters. There is no Authorization header form.

• Actions: Create Certificate, Validate CSR, Verify Domains, Get Verification Status, Get Certificate, List Certificates, Download Certificate, Cancel Certificate, Revoke Certificate, Resend Verification Email.
• Triggers: Certificate Expiring Soon (polling).

Connection: sign in at app.zerossl.com, click the Developer tab in the left-hand navigation (or go straight to app.zerossl.com/developer) and copy the API access key shown at the top of the page.

⚠️ The same Developer page also lists EAB credentials — an EAB KID and an EAB HMAC key — for ZeroSSL's ACME endpoint. They are not interchangeable. Copy the API access key; pasting an EAB value produces invalid_access_key on every step.

Notes

• This piece automates the certificate lifecycle, not the proof of domain ownership. Create Certificate returns a certificate in the draft state; nothing is issued until you have published a proof outside TaskMagic and then run Verify Domains. What Create Certificate gives you is the exact proof to publish, under validation:

  • EMAIL — pick one address per domain from validation.email_validation, then open the e-mail ZeroSSL sends and click through. A human has to read that mailbox.
  • CNAME_CSR_HASH — create a CNAME record with Name = cname_validation_p1 and Points To = cname_validation_p2. Subject to DNS propagation delay, so expect to poll.
  • HTTP_CSR_HASH / HTTPS_CSR_HASH — upload a file so that http(s)://<domain>/.well-known/pki-validation/<HASH>.txt returns HTTP 200 containing the exact three lines from file_validation_content.

  Pairing Create Certificate with a DNS-provider piece (Cloudflare, for example) is what makes the CNAME path fully hands-off.

• You must supply your own CSR, and that is deliberate. ZeroSSL has no endpoint that generates one, and TaskMagic will not generate one either — doing so would mean creating and holding your private key. Generate it where the key belongs and keep private.key yourself:

  openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr

  ZeroSSL enforces: a 2048-bit or 4096-bit key; a Common Name equal to the first entry in Certificate Domains (error 2836 otherwise); a Country (C) field (2844); and a wildcard Common Name only on a wildcard certificate (28181 / 28182). A fresh CSR per certificate is recommended. Validate CSR checks all of this before you spend a certificate slot, and returns valid: false as data rather than failing the step so a flow can branch on it.

• A 200 response does not mean success. ZeroSSL answers successful and failed calls with HTTP 200, and its docs state that the 4xx/5xx codes it sometimes uses "might change". Every call here is therefore judged on the body — success === false or an error object — never on the status code. The documented error codes are mapped to messages that name the field to fix, and CNAME failures surface ZeroSSL's target_host / target_record verbatim because that is the exact record you need to publish.

• Lists are comma-separated strings, not JSON arrays. Certificate Domains, Validation Emails and the List Certificates filters are all collected as list-shaped inputs in the builder and joined with commas before being sent; passing a real array is one of the documented ways to get invalid_request_body.

• Typical flow: Create Certificate → publish the CNAME record or validation file (or pair with a DNS piece) → Verify Domains → poll Get Verification Status on a delay loop until validation_completed is 1 → Download Certificate.

• Download Certificate is fixed to the json method. Of ZeroSSL's five download formats, json is the only one that yields a usable step output: it returns certificate.crt and ca_bundle.crt as PEM strings. zip is binary, pem / chain / xml are non-JSON text bodies, and return is deprecated. Only issued certificates are downloadable — anything else fails with 2832 / 2860.

• Cancel and Revoke are not the same thing. Cancel applies to a draft or pending_validation certificate and frees its slot (2833 if it is already issued). Revoke is destructive and irreversible — browsers immediately start rejecting the certificate, and restoring HTTPS means issuing and installing a new one.

• IP-address certificates can only be validated by file upload, and IPv6 is not supported (error 2843).

• No webhooks exist. ZeroSSL's REST API publishes no webhook or callback mechanism, so Certificate Expiring Soon polls GET /certificates?certificate_status=expiring_soon and dedupes on the certificate id. Results are sorted by expires descending, which is what makes the last-item cursor correct: a certificate only enters the expiring-soon window when the clock reaches its own expiry window, so newer entrants always have a later expiry than everything already seen. Certificates expire at midnight, so same-day expiries tie; the id breaks ties so the order cannot shuffle between polls and re-fire something already delivered. Every page is read (100 at a time, up to 2000 certificates) so a large account is not silently truncated.

• ACME is deliberately not implemented. ZeroSSL's other interface — https://acme.zerossl.com/v2/DV90 with EAB credentials — is RFC 8555: stateful, nonce-chained and JWS-signed. It cannot be expressed as stateless HTTP steps in a flow, and an ACME client (certbot, acme.sh, Caddy) is the right tool for it.

• Plan caveat. ZeroSSL's Developer page says REST API access requires a "Pro Plan or higher", but the current tiers (Free / Basic / Premium / Business / Platinum) all list REST API access and no plan is called "Pro" any more — the sentence looks stale. If a step fails with permission_denied (2801), the plan is the thing to check.

• Rate limits and quotas. ZeroSSL documents no REST rate limit and describes API request volume as free and unlimited, but there is an account-level certificate quota — error 2817, surfaced as a message telling you to cancel unused certificates or upgrade. Every request is bounded by a 30-second timeout so a stalled call cannot wedge the polling trigger.

• No custom API call action. A passthrough would hand this connection's access key to any URL a flow supplies, and the whole documented certificate lifecycle is already covered above.