TLS automation with DNS API

In this workflow, you order a certificate through the TLS API, read the required DCV DNS records directly from the response, create them through the DNS API, and then poll the order status until the certificate is ready to download.

For most Linux deployments, regfish certbro is now the faster and more practical starting point because ordering, DNS DCV, key rotation, deployment, and renewals are already bundled into one CLI. This manual recipe is mainly useful when you intentionally want to build the flow directly at the API level into your own integrations, jobs, or other runtime environments.

Prerequisites

• a valid API key with access to TLS and DNS endpoints
• a zone that is already managed through regfish DNS
• a prepared CSR for the desired common name
• a process that polls the order status again at intervals

Step 1: Order the certificate or trigger a renewal

The request to POST /tls/certificate returns the domain validation data alongside the order ID. For automated DCV, validation.dns_records is especially important.

curl --request POST \
  --url 'https://api.regfish.com/tls/certificate' \
  --header 'content-type: application/json' \
  --header 'x-api-key: YOUR_API_KEY' \
  --data '
{
  "sku": "RapidSSL",
  "common_name": "www.example.com",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIC...\n-----END CERTIFICATE REQUEST-----",
  "dcv_method": "dns-cname-token"
}
'

If the same request should explicitly be treated as a renewal of an existing certificate, add renewal_of_certificate_id. The API then creates a new order while linking it commercially to the previous certificate.

{
  "renewal_of_certificate_id": "7K9QW3M2ZT8HJ"
}

For renewal orders, keep in mind that validity_days remains the purchased base validity. Once the certificate has actually been issued, valid_until is authoritative for the effective lifetime, and renewal_bonus_days may appear if the provider credits remaining validity from the previous certificate.

The response typically contains a block like this:

{
  "success": true,
  "response": {
    "id": "9M4TR8C6X2HP7",
    "status": "pending",
    "common_name": "www.example.com",
    "validation": {
      "method": "dns-cname-token",
      "dns_records": [
        {
          "name": "_dnsauth.example.com.",
          "type": "CNAME",
          "value": "0123456789abcdef.dcv.digicert.com."
        }
      ]
    }
  }
}

Step 2: Create the DCV record through the DNS API

Take the returned record from validation.dns_records and write it directly into the matching zone. This is the step that makes the workflow automatable, especially as certificate lifetimes continue to get shorter.

curl --request POST \
  --url 'https://api.regfish.com/dns/rr' \
  --header 'content-type: application/json' \
  --header 'x-api-key: YOUR_API_KEY' \
  --data '
{
  "type": "CNAME",
  "name": "_dnsauth.example.com",
  "data": "0123456789abcdef.dcv.digicert.com.",
  "ttl": 300
}
'

Step 3: Poll the order status

After the DNS record has propagated, poll the certificate status regularly. As soon as the CA has seen the record, the status moves into a downloadable state.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/9M4TR8C6X2HP7' \
  --header 'x-api-key: YOUR_API_KEY'

Pay special attention to:

• status
• order_state
• valid_until
• renewal_bonus_days, if this order is a provider-linked renewal
• whether certificate_pem_available is already true

Step 4: Download the certificate

Once the order has been validated and issued successfully, you can fetch the certificate directly and hand it over to the next deployment steps.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/9M4TR8C6X2HP7/download/pem' \
  --header 'x-api-key: YOUR_API_KEY' \
  --output 'certificate-9M4TR8C6X2HP7.pem'

Practical notes for production workflows

• create DNS DCV records with a short TTL so corrections take effect faster
• store the certificate ID immediately after ordering for later polling and download steps
• separate ordering, DNS updates, and status checks into dedicated jobs or queues
• log every DNS record requested by the CA so failures can be diagnosed quickly

Result

This workflow automates not just the order itself, but also the DCV step that will matter even more with shorter certificate lifetimes. The same pattern works for both first-time orders and explicit renewals through renewal_of_certificate_id.