About the SSL Certificate API

The SSL Certificate API lets you install your own SSL certificate on the domains connected to a site in your Wix Enterprise account, instead of the certificate Wix issues automatically. Use it when your organization requires certificates from a specific certificate authority, or manages certificates centrally for all of its domains.

With the SSL Certificate API, you can:

• Install a custom certificate for the domains connected to a site.
• Retrieve the certificate a domain currently serves.

A domain must be connected to the site before you install a certificate for it. To connect a domain, use the Connected Domains API. To find the ID of a site in the account, call Query Sites in the Sites API.

Before you begin

It's important to note the following points before starting to code:

• This API is called with an Enterprise API key. Send the key in the Authorization header and the ID of the account that owns the key in the wix-account-id header. The key needs the Manage Site SSL & Publish State permission scope.
• Every request identifies the site in metaSiteId. Every domain you pass must be connected to that site.
• The private key must be a 2048-bit RSA key that matches the certificate. Keys of other types or sizes are rejected.
• domainNames must list exactly the domains in the certificate's subject alternative names. Issue the certificate for both the apex domain and its www name, and pass both.
• The certificate must stay valid for at least 2 more months from the day you install it. Wix's guidance for manual uploads asks for 3 months, which leaves time to renew.
• Upload a new certificate before the current certificate expires to keep the domain on your own certificate.

Use cases

• Install your own certificate on a site's domains

Terminology

• PEM bundle: A single text block that concatenates the private key, the site certificate, and the intermediate certificates, each in PEM format with its own BEGIN and END lines.
• Subject alternative names: The list of domains a certificate is valid for. The domains you pass in domainNames must match this list exactly.
• Apex domain: The domain without a subdomain prefix, such as example.com. Its www name is www.example.com.