Create Custom Hostname

custom_hostnames.create() -> CustomHostnameCreateResponse

POST/zones/{zone_id}/custom_hostnames

Add a new custom hostname and request that an SSL certificate be issued for it. One of three validation methods—http, txt, email—should be used, with 'http' recommended if the CNAME is already in place (or will be soon). Specifying 'email' will send an email to the WHOIS contacts on file for the base domain plus hostmaster, postmaster, webmaster, admin, administrator. If http is used and the domain is not already pointing to the Managed CNAME host, the PATCH method must be used once it is (to complete validation). Enable bundling of certificates using the custom_cert_bundle field. The bundling process requires the following condition One certificate in the bundle must use an RSA, and the other must use an ECDSA.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

Accepted Permissions (at least one required)

SSL and Certificates Write

ParametersExpand Collapse

zone_id: str

Identifier.

maxLength32

hostname: str

The custom hostname that will point to your hostname via CNAME.

maxLength255

custom_metadata: Optional[Dict[str, str]]

Unique key/value metadata for this hostname. These are per-hostname (customer) settings.

ssl: Optional[SSL]

SSL properties used when creating the custom hostname.

bundle_method: Optional[BundleMethod]

A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it.

One of the following:

"ubiquitous"

"optimal"

"force"

certificate_authority: Optional[CertificateCA]

The Certificate Authority that will issue the certificate

One of the following:

"digicert"

"google"

"lets_encrypt"

"ssl_com"

cloudflare_branding: Optional[bool]

Whether or not to add Cloudflare Branding for the order. This will add a subdomain of sni.cloudflaressl.com as the Common Name if set to true

custom_cert_bundle: Optional[Iterable[SSLCustomCERTBundle]]

Array of custom certificate and key pairs (1 or 2 pairs allowed)

custom_certificate: str

If a custom uploaded certificate is used.

custom_key: str

The key for a custom uploaded certificate.

custom_certificate: Optional[str]

If a custom uploaded certificate is used.

custom_csr_id: Optional[str]

The identifier for the Custom CSR that was used.

custom_key: Optional[str]

The key for a custom uploaded certificate.

method: Optional[DCVMethod]

Domain control validation (DCV) method used for this hostname.

One of the following:

"http"

"txt"

"email"

settings: Optional[SSLSettings]

SSL specific settings.

ciphers: Optional[SequenceNotStr[str]]

An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.

early_hints: Optional[Literal["on", "off"]]

Whether or not Early Hints is enabled.

One of the following:

"on"

"off"

http2: Optional[Literal["on", "off"]]

Whether or not HTTP2 is enabled.

One of the following:

"on"

"off"

min_tls_version: Optional[Literal["1.0", "1.1", "1.2", "1.3"]]

The minimum TLS version supported.

One of the following:

"1.0"

"1.1"

"1.2"

"1.3"

tls_1_3: Optional[Literal["on", "off"]]

Whether or not TLS 1.3 is enabled.

One of the following:

"on"

"off"

type: Optional[DomainValidationType]

Level of validation to be used for this hostname. Domain validation (dv) must be used.

wildcard: Optional[bool]

Indicates whether the certificate covers a wildcard.

ReturnsExpand Collapse

class CustomHostnameCreateResponse: …

id: str

Identifier.

maxLength32

hostname: str

The custom hostname that will point to your hostname via CNAME.

maxLength255

created_at: Optional[datetime]

This is the time the hostname was created.

formatdate-time

custom_metadata: Optional[Dict[str, str]]

Unique key/value metadata for this hostname. These are per-hostname (customer) settings.

custom_origin_server: Optional[str]

a valid hostname that’s been added to your DNS zone as an A, AAAA, or CNAME record.

custom_origin_sni: Optional[str]

A hostname that will be sent to your custom origin server as SNI for TLS handshake. This can be a valid subdomain of the zone or custom origin server name or the string ':request_host_header:' which will cause the host header in the request to be used as SNI. Not configurable with default/fallback origin server.

ownership_verification: Optional[OwnershipVerification]

This is a record which can be placed to activate a hostname.

name: Optional[str]

DNS Name for record.

type: Optional[Literal["txt"]]

DNS Record type.

value: Optional[str]

Content for the record.

ownership_verification_http: Optional[OwnershipVerificationHTTP]

This presents the token to be served by the given http url to activate a hostname.

http_body: Optional[str]

Token to be served.

http_url: Optional[str]

The HTTP URL that will be checked during custom hostname verification and where the customer should host the token.

ssl: Optional[SSL]

id: Optional[str]

Custom hostname SSL identifier tag.

maxLength36

minLength36

bundle_method: Optional[BundleMethod]

One of the following:

"ubiquitous"

"optimal"

"force"

certificate_authority: Optional[CertificateCA]

The Certificate Authority that will issue the certificate

One of the following:

"digicert"

"google"

"lets_encrypt"

"ssl_com"

custom_certificate: Optional[str]

If a custom uploaded certificate is used.

custom_csr_id: Optional[str]

The identifier for the Custom CSR that was used.

custom_key: Optional[str]

The key for a custom uploaded certificate.

dcv_delegation_records: Optional[List[SsldcvDelegationRecord]]

DCV Delegation records for domain validation.

cname: Optional[str]

The CNAME record hostname for DCV delegation.

cname_target: Optional[str]

The CNAME record target value for DCV delegation.

emails: Optional[List[str]]

The set of email addresses that the certificate authority (CA) will use to complete domain validation.

http_body: Optional[str]

The content that the certificate authority (CA) will expect to find at the http_url during the domain validation.

http_url: Optional[str]

The url that will be checked during domain validation.

status: Optional[str]

Status of the validation record.

txt_name: Optional[str]

The hostname that the certificate authority (CA) will check for a TXT record during domain validation .

txt_value: Optional[str]

The TXT record that the certificate authority (CA) will check during domain validation.

expires_on: Optional[datetime]

The time the custom certificate expires on.

formatdate-time

hosts: Optional[List[str]]

A list of Hostnames on a custom uploaded certificate.

issuer: Optional[str]

The issuer on a custom uploaded certificate.

method: Optional[DCVMethod]

Domain control validation (DCV) method used for this hostname.

One of the following:

"http"

"txt"

"email"

serial_number: Optional[str]

The serial number on a custom uploaded certificate.

settings: Optional[SSLSettings]

ciphers: Optional[List[str]]

An allowlist of ciphers for TLS termination. These ciphers must be in the BoringSSL format.

early_hints: Optional[Literal["on", "off"]]

Whether or not Early Hints is enabled.

One of the following:

"on"

"off"

http2: Optional[Literal["on", "off"]]

Whether or not HTTP2 is enabled.

One of the following:

"on"

"off"

min_tls_version: Optional[Literal["1.0", "1.1", "1.2", "1.3"]]

The minimum TLS version supported.

One of the following:

"1.0"

"1.1"

"1.2"

"1.3"

tls_1_3: Optional[Literal["on", "off"]]

Whether or not TLS 1.3 is enabled.

One of the following:

"on"

"off"

signature: Optional[str]

The signature on a custom uploaded certificate.

status: Optional[Literal["initializing", "pending_validation", "deleted", 18 more]]

Status of the hostname's SSL certificates.

One of the following:

"initializing"

"pending_validation"

"deleted"

"pending_issuance"

"pending_deployment"

"pending_deletion"

"pending_expiration"

"expired"

"active"

"initializing_timed_out"

"validation_timed_out"

"issuance_timed_out"

"deployment_timed_out"

"deletion_timed_out"

"pending_cleanup"

"staging_deployment"

"staging_active"

"deactivating"

"inactive"

"backup_issued"

"holding_deployment"

type: Optional[DomainValidationType]

Level of validation to be used for this hostname. Domain validation (dv) must be used.

uploaded_on: Optional[datetime]

The time the custom certificate was uploaded.

formatdate-time

validation_errors: Optional[List[SSLValidationError]]

Domain validation errors that have been received by the certificate authority (CA).

message: Optional[str]

A domain validation error.

validation_records: Optional[List[SSLValidationRecord]]

cname: Optional[str]

The CNAME record hostname for DCV delegation.

cname_target: Optional[str]

The CNAME record target value for DCV delegation.

emails: Optional[List[str]]

The set of email addresses that the certificate authority (CA) will use to complete domain validation.

http_body: Optional[str]

The content that the certificate authority (CA) will expect to find at the http_url during the domain validation.

http_url: Optional[str]

The url that will be checked during domain validation.

status: Optional[str]

Status of the validation record.

txt_name: Optional[str]

The hostname that the certificate authority (CA) will check for a TXT record during domain validation .

txt_value: Optional[str]

The TXT record that the certificate authority (CA) will check during domain validation.

wildcard: Optional[bool]

Indicates whether the certificate covers a wildcard.

status: Optional[Literal["active", "pending", "active_redeploying", 13 more]]

Status of the hostname's activation.

One of the following:

"active"

"pending"

"active_redeploying"

"moved"

"pending_deletion"

"deleted"

"pending_blocked"

"pending_migration"

"pending_provisioned"

"test_pending"

"test_active"

"test_active_apex"

"test_blocked"

"test_failed"

"provisioned"

"blocked"

verification_errors: Optional[List[str]]

These are errors that were encountered while trying to activate a hostname.

Create Custom Hostname

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
custom_hostname = client.custom_hostnames.create(
    zone_id="023e105f4ecef8ad9ca31a8372d0c353",
    hostname="app.example.com",
)
print(custom_hostname.id)

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "hostname": "app.example.com",
    "created_at": "2020-02-06T18:11:23.531995Z",
    "custom_metadata": {
      "foo": "string"
    },
    "custom_origin_server": "origin2.example.com",
    "custom_origin_sni": "sni.example.com",
    "ownership_verification": {
      "name": "_cf-custom-hostname.app.example.com",
      "type": "txt",
      "value": "5cc07c04-ea62-4a5a-95f0-419334a875a4"
    },
    "ownership_verification_http": {
      "http_body": "5cc07c04-ea62-4a5a-95f0-419334a875a4",
      "http_url": "http://custom.test.com/.well-known/cf-custom-hostname-challenge/0d89c70d-ad9f-4843-b99f-6cc0252067e9"
    },
    "ssl": {
      "id": "0d89c70d-ad9f-4843-b99f-6cc0252067e9",
      "bundle_method": "ubiquitous",
      "certificate_authority": "google",
      "custom_certificate": "-----BEGIN CERTIFICATE-----\nMIIFJDCCBAygAwIBAgIQD0ifmj/Yi5NP/2gdUySbfzANBgkqhkiG9w0BAQsFADBN\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E...SzSHfXp5lnu/3V08I72q1QNzOCgY1XeL4GKVcj4or6cT6tX6oJH7ePPmfrBfqI/O\nOeH8gMJ+FuwtXYEPa4hBf38M5eU5xWG7\n-----END CERTIFICATE-----\n",
      "custom_csr_id": "7b163417-1d2b-4c84-a38a-2fb7a0cd7752",
      "custom_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG\ndtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn\nabIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid\ntnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py\nFxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE\newooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb\nHBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/\naxiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb\n+ufRBKztPTQ/rYWaYQcgC0RWI20HTFBMxlTAyNxYNWzX7RKFkGVVyB9RsAtmcc8g\n+j4OdosbfNoJPS0HeIfNpAznDfHKdxDk2Yc1tV6RHBrC1ynyLE9+TaflIAdo2MVv\nKLMLq51GqYKtgJFIlBRPQqKoyXdz3fGvXrTkf/WY9QNq0J1Vk5ERePZ54mN8iZB7\n9lwy/AkCgYEA6FXzosxswaJ2wQLeoYc7ceaweX/SwTvxHgXzRyJIIT0eJWgx13Wo\n/WA3Iziimsjf6qE+SI/8laxPp2A86VMaIt3Z3mJN/CqSVGw8LK2AQst+OwdPyDMu\niacE8lj/IFGC8mwNUAb9CzGU3JpU4PxxGFjS/eMtGeRXCWkK4NE+G08CgYEA1Kp9\nN2JrVlqUz+gAX+LPmE9OEMAS9WQSQsfCHGogIFDGGcNf7+uwBM7GAaSJIP01zcoe\nVAgWdzXCv3FLhsaZoJ6RyLOLay5phbu1iaTr4UNYm5WtYTzMzqh8l1+MFFDl9xDB\nvULuCIIrglM5MeS/qnSg1uMoH2oVPj9TVst/ir8CgYEAxrI7Ws9Zc4Bt70N1As+U\nlySjaEVZCMkqvHJ6TCuVZFfQoE0r0whdLdRLU2PsLFP+q7qaeZQqgBaNSKeVcDYR\n9B+nY/jOmQoPewPVsp/vQTCnE/R81spu0mp0YI6cIheT1Z9zAy322svcc43JaWB7\nmEbeqyLOP4Z4qSOcmghZBSECgYACvR9Xs0DGn+wCsW4vze/2ei77MD4OQvepPIFX\ndFZtlBy5ADcgE9z0cuVB6CiL8DbdK5kwY9pGNr8HUCI03iHkW6Zs+0L0YmihfEVe\nPG19PSzK9CaDdhD9KFZSbLyVFmWfxOt50H7YRTTiPMgjyFpfi5j2q348yVT0tEQS\nfhRqaQKBgAcWPokmJ7EbYQGeMbS7HC8eWO/RyamlnSffdCdSc7ue3zdVJxpAkQ8W\nqu80pEIF6raIQfAf8MXiiZ7auFOSnHQTXUbhCpvDLKi0Mwq3G8Pl07l+2s6dQG6T\nlv6XTQaMyf6n1yjzL+fzDrH3qXMxHMO/b13EePXpDMpY7HQpoLDi\n-----END RSA PRIVATE KEY-----\n",
      "dcv_delegation_records": [
        {
          "cname": "_acme-challenge.example.com",
          "cname_target": "dcv.cloudflare.com",
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "status": "pending",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "expires_on": "2021-02-06T18:11:23.531995Z",
      "hosts": [
        "app.example.com",
        "*.app.example.com"
      ],
      "issuer": "DigiCertInc",
      "method": "http",
      "serial_number": "6743787633689793699141714808227354901",
      "settings": {
        "ciphers": [
          "ECDHE-RSA-AES128-GCM-SHA256",
          "AES128-SHA"
        ],
        "early_hints": "on",
        "http2": "on",
        "min_tls_version": "1.2",
        "tls_1_3": "on"
      },
      "signature": "SHA256WithRSA",
      "status": "pending_validation",
      "type": "dv",
      "uploaded_on": "2020-02-06T18:11:23.531995Z",
      "validation_errors": [
        {
          "message": "SERVFAIL looking up CAA for app.example.com"
        }
      ],
      "validation_records": [
        {
          "cname": "_acme-challenge.example.com",
          "cname_target": "dcv.cloudflare.com",
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "status": "pending",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "wildcard": false
    },
    "status": "pending",
    "verification_errors": [
      "None of the A or AAAA records are owned by this account and the pre-generated ownership verification token was not found."
    ]
  }
}

Returns Examples

{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "hostname": "app.example.com",
    "created_at": "2020-02-06T18:11:23.531995Z",
    "custom_metadata": {
      "foo": "string"
    },
    "custom_origin_server": "origin2.example.com",
    "custom_origin_sni": "sni.example.com",
    "ownership_verification": {
      "name": "_cf-custom-hostname.app.example.com",
      "type": "txt",
      "value": "5cc07c04-ea62-4a5a-95f0-419334a875a4"
    },
    "ownership_verification_http": {
      "http_body": "5cc07c04-ea62-4a5a-95f0-419334a875a4",
      "http_url": "http://custom.test.com/.well-known/cf-custom-hostname-challenge/0d89c70d-ad9f-4843-b99f-6cc0252067e9"
    },
    "ssl": {
      "id": "0d89c70d-ad9f-4843-b99f-6cc0252067e9",
      "bundle_method": "ubiquitous",
      "certificate_authority": "google",
      "custom_certificate": "-----BEGIN CERTIFICATE-----\nMIIFJDCCBAygAwIBAgIQD0ifmj/Yi5NP/2gdUySbfzANBgkqhkiG9w0BAQsFADBN\nMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E...SzSHfXp5lnu/3V08I72q1QNzOCgY1XeL4GKVcj4or6cT6tX6oJH7ePPmfrBfqI/O\nOeH8gMJ+FuwtXYEPa4hBf38M5eU5xWG7\n-----END CERTIFICATE-----\n",
      "custom_csr_id": "7b163417-1d2b-4c84-a38a-2fb7a0cd7752",
      "custom_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAwQHoetcl9+5ikGzV6cMzWtWPJHqXT3wpbEkRU9Yz7lgvddmG\ndtcGbg/1CGZu0jJGkMoppoUo4c3dts3iwqRYmBikUP77wwY2QGmDZw2FvkJCJlKn\nabIRuGvBKwzESIXgKk2016aTP6/dAjEHyo6SeoK8lkIySUvK0fyOVlsiEsCmOpid\ntnKX/a+50GjB79CJH4ER2lLVZnhePFR/zUOyPxZQQ4naHf7yu/b5jhO0f8fwt+py\nFxIXjbEIdZliWRkRMtzrHOJIhrmJ2A1J7iOrirbbwillwjjNVUWPf3IJ3M12S9pE\newooaeO2izNTERcG9HzAacbVRn2Y2SWIyT/18QIDAQABAoIBACbhTYXBZYKmYPCb\nHBR1IBlCQA2nLGf0qRuJNJZg5iEzXows/6tc8YymZkQE7nolapWsQ+upk2y5Xdp/\naxiuprIs9JzkYK8Ox0r+dlwCG1kSW+UAbX0bQ/qUqlsTvU6muVuMP8vZYHxJ3wmb\n+ufRBKztPTQ/rYWaYQcgC0RWI20HTFBMxlTAyNxYNWzX7RKFkGVVyB9RsAtmcc8g\n+j4OdosbfNoJPS0HeIfNpAznDfHKdxDk2Yc1tV6RHBrC1ynyLE9+TaflIAdo2MVv\nKLMLq51GqYKtgJFIlBRPQqKoyXdz3fGvXrTkf/WY9QNq0J1Vk5ERePZ54mN8iZB7\n9lwy/AkCgYEA6FXzosxswaJ2wQLeoYc7ceaweX/SwTvxHgXzRyJIIT0eJWgx13Wo\n/WA3Iziimsjf6qE+SI/8laxPp2A86VMaIt3Z3mJN/CqSVGw8LK2AQst+OwdPyDMu\niacE8lj/IFGC8mwNUAb9CzGU3JpU4PxxGFjS/eMtGeRXCWkK4NE+G08CgYEA1Kp9\nN2JrVlqUz+gAX+LPmE9OEMAS9WQSQsfCHGogIFDGGcNf7+uwBM7GAaSJIP01zcoe\nVAgWdzXCv3FLhsaZoJ6RyLOLay5phbu1iaTr4UNYm5WtYTzMzqh8l1+MFFDl9xDB\nvULuCIIrglM5MeS/qnSg1uMoH2oVPj9TVst/ir8CgYEAxrI7Ws9Zc4Bt70N1As+U\nlySjaEVZCMkqvHJ6TCuVZFfQoE0r0whdLdRLU2PsLFP+q7qaeZQqgBaNSKeVcDYR\n9B+nY/jOmQoPewPVsp/vQTCnE/R81spu0mp0YI6cIheT1Z9zAy322svcc43JaWB7\nmEbeqyLOP4Z4qSOcmghZBSECgYACvR9Xs0DGn+wCsW4vze/2ei77MD4OQvepPIFX\ndFZtlBy5ADcgE9z0cuVB6CiL8DbdK5kwY9pGNr8HUCI03iHkW6Zs+0L0YmihfEVe\nPG19PSzK9CaDdhD9KFZSbLyVFmWfxOt50H7YRTTiPMgjyFpfi5j2q348yVT0tEQS\nfhRqaQKBgAcWPokmJ7EbYQGeMbS7HC8eWO/RyamlnSffdCdSc7ue3zdVJxpAkQ8W\nqu80pEIF6raIQfAf8MXiiZ7auFOSnHQTXUbhCpvDLKi0Mwq3G8Pl07l+2s6dQG6T\nlv6XTQaMyf6n1yjzL+fzDrH3qXMxHMO/b13EePXpDMpY7HQpoLDi\n-----END RSA PRIVATE KEY-----\n",
      "dcv_delegation_records": [
        {
          "cname": "_acme-challenge.example.com",
          "cname_target": "dcv.cloudflare.com",
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "status": "pending",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "expires_on": "2021-02-06T18:11:23.531995Z",
      "hosts": [
        "app.example.com",
        "*.app.example.com"
      ],
      "issuer": "DigiCertInc",
      "method": "http",
      "serial_number": "6743787633689793699141714808227354901",
      "settings": {
        "ciphers": [
          "ECDHE-RSA-AES128-GCM-SHA256",
          "AES128-SHA"
        ],
        "early_hints": "on",
        "http2": "on",
        "min_tls_version": "1.2",
        "tls_1_3": "on"
      },
      "signature": "SHA256WithRSA",
      "status": "pending_validation",
      "type": "dv",
      "uploaded_on": "2020-02-06T18:11:23.531995Z",
      "validation_errors": [
        {
          "message": "SERVFAIL looking up CAA for app.example.com"
        }
      ],
      "validation_records": [
        {
          "cname": "_acme-challenge.example.com",
          "cname_target": "dcv.cloudflare.com",
          "emails": [
            "administrator@example.com",
            "webmaster@example.com"
          ],
          "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
          "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
          "status": "pending",
          "txt_name": "_acme-challenge.app.example.com",
          "txt_value": "810b7d5f01154524b961ba0cd578acc2"
        }
      ],
      "wildcard": false
    },
    "status": "pending",
    "verification_errors": [
      "None of the A or AAAA records are owned by this account and the pre-generated ownership verification token was not found."
    ]
  }
}