Set Active Certificate
Switch which previously-issued certificate is currently being served for the domain. Most users never need this — the platform automatically picks the freshest valid cert and renews ahead of expiry. Use this only when:
- A new cert was issued but you want to keep serving the old one for HPKP pinning compatibility.
- A new cert has a problem (wrong SANs, etc.) and you need to roll back to the previous one.
- You issued a custom cert manually and want to make it active explicitly.
The change takes effect on the next TLS handshake at the edge — typically < 1 second after this call returns. Existing connections continue with their previously-negotiated cert until they reconnect.
Path parameters
uuid string (uuid) Req
Domain UUID.
Request body
certificate_id int64 Req
Numeric ID of a cert previously issued for this domain. Get from /certificates. Cert must be valid (not expired) and belong to this domain.
Response (200 OK)
active_certificate_id int64
The new active cert ID (echo).
Errors
400 Bad Request
Missing
certificate_id, or the cert is expired/revoked.401 Unauthorized
Missing auth.
404 Not Found
Domain or certificate doesn't exist; cert doesn't belong to this domain.
Request
curl -X PUT "https://api.ngris.com/v1/domains/self/<uuid>/active-cert" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{"certificate_id": 7}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client._put_raw(
"/domains/self/<domain_uuid>/active-cert",
{"certificate_id": 7},
)
Response — 200 OK
{
"active_certificate_id": 7
}