Renew or revoke a Let's Encrypt certificate

Renew or revoke a Let's Encrypt certificate that already shows Success on the CDN resource. Renewal runs while that certificate is still active.

Renew the certificate

While the resource is active, the certificate renews automatically. CDB makes one automatic renewal attempt 30 days before the current certificate expires.

That attempt is separate from initial issuance, which reaches Failed only after five unsuccessful attempts. If the certificate is not reissued, a notification is sent to the account email address.

After an unsuccessful reissue attempt, the current certificate stays active for another 30 days. After the certificate's end date, content is unavailable over HTTPS.

The Failed status also appears when automatic renewal does not complete. Correct the error, including the domain DNS records, and click Renew certificate while the current certificate is still active.

Renew certificate issues a new certificate and attaches it to the CDN resource. A later revoke and a new issuance turn HTTPS off until the new certificate is issued.

Revoke the certificate

In the resource settings, open the SSL section and click Revoke Let's Encrypt certificate. Personal certificates are available for selection after the Let's Encrypt certificate is revoked.

An API request replaces the Let's Encrypt certificate with an uploaded certificate while HTTPS stays enabled.

Renew a Let's Encrypt certificate whose latest status is DONE and whose issuance is not active, or revoke it and delete the certificate object afterward. CDB also makes one automatic renewal attempt 30 days before validity_not_after.

ℹ️

An API token is required. The CDN resource ID is visible under CDN → CDN Resources.

Open a terminal and export the required variables:

export GCORE_API_KEY="{YOUR_API_KEY}"
export CDN_RESOURCE_ID="{YOUR_CDN_RESOURCE_ID}"
export CDN_SSL_CERTIFICATE_ID="{YOUR_SSL_CERTIFICATE_ID}"

Renew the certificate

While active is true, renewal returns HTTP 400: Certificate issuing process has already been launched.

The next issuance or renewal uses ECDSA unless use_rsa_le_cert is enabled first. Enable that option in the Let's Encrypt certificate article before the first attach or before this call.

import os

from gcore import CDB

client = CDB()
certificate_id = int(os.environ["CDN_SSL_CERTIFICATE_ID"])

client.cdn.certificates.renew(certificate_id)

package main

import (
    "context"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    certificateID, err := strconv.ParseInt(os.Getenv("CDN_SSL_CERTIFICATE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    err = client.CDN.Certificates.Renew(ctx, certificateID)
    if err != nil {
        panic(err)
    }
}

curl -X POST "https://api.cdb-staging.cdn.orange.com/cdn/sslData/$CDN_SSL_CERTIFICATE_ID/renew" \
  -H "Authorization: APIKey $GCORE_API_KEY"

When renewal starts, the API returns HTTP 201:

{}

Revoke the certificate

Revoke turns HTTPS off and clears sslData. The certificate object remains, and in the Go response a null sslData prints as 0.

import os

from gcore import CDB

client = CDB()
resource_id = int(os.environ["CDN_RESOURCE_ID"])

revoked = client.cdn.cdn_resources.update(
    resource_id,
    ssl_enabled=False,
    ssl_data=None,
)
print(revoked.ssl_enabled, revoked.ssl_data)

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
    "github.com/G-Core/gcore-go/packages/param"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    resourceID, err := strconv.ParseInt(os.Getenv("CDN_RESOURCE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    revoked, err := client.CDN.CDNResources.Update(ctx, resourceID, cdn.CDNResourceUpdateParams{
        SslEnabled: gcore.Bool(false),
        SslData:    param.Null[int64](),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(revoked.SslEnabled, revoked.SslData)
}

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/cdn/resources/$CDN_RESOURCE_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sslEnabled": false,
    "sslData": null
  }'

The API returns HTTP 200:

{
  "id": 101,
  "sslEnabled": false,
  "sslData": null
}

Delete the certificate object

Delete the certificate object only after the resource shows sslData as null. DELETE returns HTTP 204 and an empty body.

import os

from gcore import CDB

client = CDB()
certificate_id = int(os.environ["CDN_SSL_CERTIFICATE_ID"])

client.cdn.certificates.delete(certificate_id)

package main

import (
    "context"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()
    certificateID, err := strconv.ParseInt(os.Getenv("CDN_SSL_CERTIFICATE_ID"), 10, 64)
    if err != nil {
        panic(err)
    }

    err = client.CDN.Certificates.Delete(ctx, certificateID)
    if err != nil {
        panic(err)
    }
}

curl -X DELETE "https://api.cdb-staging.cdn.orange.com/cdn/sslData/$CDN_SSL_CERTIFICATE_ID" \
  -H "Authorization: APIKey $GCORE_API_KEY"

The API returns HTTP 204 and an empty body.

Revoke an attached Let's Encrypt certificate with the Terraform provider v2, or delete the CDN resource and the certificate. Renewal is automatic, or the Renew certificate control in the SSL section starts it, and Terraform apply does not renew the certificate.

Revoke the certificate

Set ssl_enabled to false and ssl_data to null, then run terraform apply. HTTPS is off, the certificate object remains, and a later terraform plan shows ssl_data empty.

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_certificate" "example" {
  name      = "cdn-le-certificate"
  automated = true
}

resource "gcore_cdn_resource" "example" {
  cname           = "le.mywebsite.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = false
  ssl_data        = null
}

Delete the resources

Run terraform destroy. The CDN resource is deleted first, then the certificate and the origin group.

terraform destroy