How to Seamlessly Migrate Your Domain to bunny.net

This feature allows you to issue an SSL certificate for your hostname before pointing your domain to bunny.net, avoiding HTTPS disruption during migration. You can verify domain control using either DNS (TXT record) validation or HTTP (file) validation, pick whichever you can perform on your current setup. In both cases issuance automatically transitions to HTTP validation for renewals once traffic is switched to bunny.net.

Create a Pull Zone

In the bunny.net dashboard, select Add Pull Zone and configure your origin.

Add your hostname

Open your Pull Zone and add your custom hostname (e.g., cdn.example.com).

The hostname must be fully configured on the Pull Zone before requesting a certificate.

Verify domain control

Prove you control the hostname using one of the methods below. Choose DNS if you can edit your domain’s DNS records, or HTTP if you can place a file on the server your domain currently points to. HTTP validation does not support wildcard hostnames, and only one verification (DNS or HTTP) can be pending per hostname at a time.

DNS (TXT record)
HTTP (file)

Request the certificate

Initiate certificate issuance using DNS validation:

curl --request POST \
  --url https://api.bunny.net/pullzone/{id}/requestExternalDnsCertificate \
  --header 'AccessKey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '
{
  "Hostname": "cdn.example.com"
}
'

This request returns the DNS TXT record required for domain verification.

API Reference

View full endpoint documentation

Create the DNS TXT record

Add the returned TXT record to your domain’s DNS zone.Example:

_acme-challenge.example.com  TXT  "verification-token"

Wait until the record is publicly resolvable before continuing.

Complete issuance

Finalize the process once the TXT record is live:

curl --request POST \
  --url https://api.bunny.net/pullzone/{id}/completeExternalDnsCertificate \
  --header 'AccessKey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '
{
  "Hostname": "cdn.example.com"
}
'

This validates the DNS record and issues the certificate.

API Reference

View full endpoint documentation

Request the certificate

Initiate certificate issuance using HTTP validation:

curl --request POST \
  --url https://api.bunny.net/pullzone/{id}/requestExternalHttpCertificate \
  --header 'AccessKey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '
{
  "Hostname": "cdn.example.com"
}
'

This request returns the challenge file’s path and its contents (FilePath and FileContent).

API Reference

View full endpoint documentation

Host the challenge file

On the server your domain currently points to, serve the returned FileContent at the returned FilePath so it is reachable over plain HTTP (port 80):

http://cdn.example.com/.well-known/acme-challenge/<token>

The response body must exactly match the FileContent value from the previous step. Redirects to HTTPS are followed during validation.

Complete issuance

Finalize the process once the file is reachable:

curl --request POST \
  --url https://api.bunny.net/pullzone/{id}/completeExternalHttpCertificate \
  --header 'AccessKey: YOUR_API_KEY' \
  --header 'Content-Type: application/json' \
  --data '
{
  "Hostname": "cdn.example.com"
}
'

This fetches the challenge file and issues the certificate.

API Reference

View full endpoint documentation

Update DNS to use your Pull Zone hostname

After the certificate is issued, update your domain’s DNS records to point to your Pull Zone hostname (e.g., yourzone.b-cdn.net).

Use a CNAME record for subdomains (e.g., cdn.example.com)
Use an ALIAS/ANAME record if configuring an apex/root domain

HTTPS will be available immediately after traffic is switched.

Automatic renewal

After the initial issuance:

Certificates automatically switch to HTTP-01 validation
Renewals happen automatically
No further DNS changes are required

For DNS validation, the TXT record must be publicly resolvable before completing the request; propagation time depends on your DNS provider
For HTTP validation, the challenge file must be reachable over plain HTTP (port 80) on the server your domain currently points to, and wildcard hostnames are not supported
Only one verification (DNS or HTTP) can be pending per hostname at a time; starting a new request replaces any previous pending one
Certificate issuance depends on successful validation by the certificate authority

Last modified on July 14, 2026

SSL for Custom Domains Custom 404 Page

Documentation

Usage

Integrations

Reference

How to Seamlessly Migrate Your Domain to bunny.net

API Reference

API Reference

API Reference

API Reference