---
title: "Order a certificate from your own CSR"
method: POST
path: "/v1/hostnames/{id}/certificate"
---

# Order a certificate from your own CSR

`POST /v1/hostnames/{id}/certificate`

## Request

- Base URL: `https://dnsmint.com/api`
- URL: `https://dnsmint.com/api/v1/hostnames/{id}/certificate`
- Auth: HTTP bearer

Only for hostnames registered with certificate: "csr". You generate the keypair and sign a PKCS#10 request over the hostname; we place the ACME order, answer the DNS-01 challenge in our zone, and store the issued chain for you to fetch. We never see the private key.

First issuance and every renewal arrive the same way - there is no difference between them from here. **Renewal is yours to schedule.** We hold no key for this hostname, so we cannot build a replacement request and nothing renews it automatically. Watch `expires_at` on the GET.

The request must name exactly the hostname you registered, and nothing else. Returns 202: the order is queued, not issued. Poll the GET.

## Path parameters

- `id` string, required

## Request body

- CertificateRequestSubmission
  - `csr` string, required: A PKCS#10 certificate request, PEM or bare base64. Must name exactly the hostname (and its wildcard when wildcard is true) in subjectAltName, and be signed by its own key. ECDSA, or RSA of at least 2048 bits, with SHA-256, SHA-384 or SHA-512.
  - `wildcard` boolean: Cover *.hostname as well. The csr must name both.
  - `ca` 'letsencrypt' | 'google': Which authority issues. Omitted, we pick. See https://dnsmint.com/ca

## Response `202`

The order was accepted and queued

- CertificateOrderAccepted
  - `id` string: The order id.
  - `state` string: Where the order is. `pending` on acceptance; it advances in the background.
  - `names` string[]: Every name the certificate will cover.
  - `ca` string: Which authority is issuing.
  - `issuer` string: That authority's name.

## Other responses

- `400`: The csr is missing, unreadable, or does not name exactly this hostname
- `401`: Missing or invalid API key
- `403`: Key lacks hostnames:write, or is narrowed to another hostname
- `404`: Hostname not found
- `409`: The hostname is not certificate: "csr", or an order is already in flight
- `429`: Too many certificate requests for this team

---

[API](https://skmtc.dev/dnsmint/apis/dnsmint-api.md) · [All operations](https://skmtc.dev/dnsmint/apis/dnsmint-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dnsmint/apis/dnsmint-api/revisions/98fb1f87725a?raw)