Skip to content
Docs sslbrain sslbrain.com

Bunny.net CDN

Copy link to the page “Bunny.net CDN”

← All integrations

Cloud service

Installs and renews public-CA certificates on selected pull-zone hostnames.

The appliance runs the package and connects to Bunny.net CDN through Bunny.net API over HTTPS on port 443. No agent is installed on Bunny.net CDN.

What happens

  1. The appliance connects to Bunny.net CDN through Bunny.net API on port 443.
  2. Discovery identifies each custom hostname by the SHA-256 fingerprint actually served by Bunny. Select targets per hostname and explicitly choose takeover where Bunny free SSL renews it.
  3. Before upload, a protected backup is saved on the appliance. A prior custom certificate needs its exact certificate and key retained by sslbrain, returned by the API or supplied for first adoption. After installation, the new pair is retained for the next renewal. If it fails: An ambiguous target or state prevents upload. An API schema field does not guarantee export of the old private key.
  4. Only the selected hostname receives the new PEM chain and key. The custom certificate takes over Bunny free SSL, and provision state must confirm Custom. Other hostnames, services, DNS, origins and global SSL settings are preserved. If it fails: Rollback restores the old custom certificate pair or removes an identified first upload from the selected hostname. Free SSL recovery requests new issuance from Bunny without first deleting a working certificate; the old fingerprint and uninterrupted recovery cannot be guaranteed.
  5. Verification uses a TLS handshake with SNI directly to the pull-zone b-cdn.net endpoint, public CA trust and the expected fingerprint. Failed activation triggers automatic recovery when the change can be identified. Recovery is also verified; unresolved state retains the backup and produces shareable logs without secrets.

Technical details

Connection
The package runs on the appliance, which connects over HTTPS to Bunny.net API, port 443. No agent is installed.
You need
Bunny.net API AccessKey with read and write access to the selected pull zone. The key is sent only in the AccessKey header to api.bunny.net. MANAGEMENT_TLS_PIN_SHA256 or MANAGEMENT_TLS_CA_BUNDLE can be selected; system trust is the default, and MANAGEMENT_TLS_INSECURE is an explicit override with a warning. Serving TLS is always checked separately with public CA trust.
Platform
Pull zones with custom hostnames
Actions
Discovery, Installation, Verification, Rollback
Packages
bunny-api 1.0.0
Note
  • BUNNY_TAKEOVER_FREE_SSL defaults to false and is selected per hostname. ForceSSL is an HTTP redirect, not automatic renewal. System and managed hostnames are not changed.
  • BUNNY_VERIFY_TIMEOUT defaults to 180 seconds and BUNNY_POLL_INTERVAL to 5; an administrator can set up to 600 and 60. A working old certificate during propagation is retained. A lost write response is reconciled before further writes; an unresolved transaction retains BACKUP_DIR for administrator recovery, while a later deployment can confirm the new activation.
  • CERTOPS_BACKUP_DIR selects a private directory under the appliance user’s .sslbrain; the default is .sslbrain/bunny-backups. Backups contain private keys and must be protected and retained for recovery. Rollback does not repeat a verified restore or overwrite a certificate changed by another operator.
  • Both official Bunny API schemas are labelled 1.0.0. The agent accepts their documented string and numeric provision state values. DNS-01 free SSL recovery uses useOnlyHttp01=false. Verification from one network location does not confirm every global PoP.
  • An expired prior certificate can be replaced when CA trust, hostname and fingerprint are confirmed. The replacement must be valid now. Restoring an expired prior pair restores its identity; it does not repair that certificate’s expiry.

Certificate requirements

Bunny documents RSA and ECDSA. sslbrain offers RSA 2048/3072/4096 and ECDSA P-256/P-384. Bunny publishes no minimum/maximum key-size or curve bounds; these choices do not describe vendor limits.

Bunny specifies neither CN-required nor explicit CN-less/SAN-only acceptance. The certificate must cover the concrete SNI hostname and pass TLS verification; tlsserver/minimal profiles are assessed through their actual certificate.

Requirements for clientAuth EKU or keyEncipherment KU are not published. The agent verifies server-certificate purpose and preserves the pull-zone TLS policy. Legacy permits static RSA while Compatible/Modern use ECDHE.

Custom wildcard certificates are documented. Wildcard bindings are verified with a concrete SNI name. IP addresses are not deployment hostnames; acceptance of additional IP-SANs and maximum SAN count are undocumented.

Upload uses separate Nginx-compatible PEM chain and key bytes in Base64 fields; readback uses Base64Url. DER/PFX/JKS are not the API upload format. PFX 3DES/RC2/AES encryption is therefore irrelevant; the API has no key-password field, and the agent sends a usable unencrypted PEM key in the protected request.

The chain must contain the leaf first followed by intermediates in order. Bunny does not document root inclusion rules. sslbrain uses its normal leaf+intermediate fullchain without adding a root; this is not a vendor prohibition on roots.

Upload has no friendly name/alias field; the binding is Hostname. Local backup labels are not Bunny aliases.

Minimum/maximum custom-certificate lifetime is not published. The replacement requires currently valid dates and public CA trust; CA and browser policies are separate. The two API schemas document no version-specific certificate bounds.

Get started