> ## Documentation Index
> Fetch the complete documentation index at: https://bunnynet-cb9733c2-database-cli-docs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Seamlessly Migrate Your Domain to bunny.net

> Issue SSL certificates via DNS or HTTP validation before pointing your domain to bunny.net, enabling seamless zero-downtime migration.

This feature allows you to issue an SSL certificate for your hostname **before pointing your domain to bunny.net**, avoiding HTTPS disruption during migration.

You can verify domain control using either **DNS (TXT record) validation** or **HTTP (file) validation**, pick whichever you can perform on your current setup. In both cases issuance automatically transitions to **HTTP validation for renewals** once traffic is switched to bunny.net.

<Steps>
  <Step title="Create a Pull Zone">
    In the [bunny.net dashboard](https://dash.bunny.net), select **Add Pull Zone** and configure your origin.

    <Frame>
      <img src="https://mintcdn.com/bunnynet-cb9733c2-database-cli-docs/m5bow_5L0NIiCspo/images/cdn/add-pull-zone.png?fit=max&auto=format&n=m5bow_5L0NIiCspo&q=85&s=ff8bf4a04ac9257594a7b8d92858df0a" alt="Add Pull Zone" width="2586" height="1230" data-path="images/cdn/add-pull-zone.png" />
    </Frame>
  </Step>

  <Step title="Add your hostname">
    Open your Pull Zone and add your custom hostname (e.g., `cdn.example.com`).

    <Frame>
      <img src="https://mintcdn.com/bunnynet-cb9733c2-database-cli-docs/m5bow_5L0NIiCspo/images/cdn/add-a-custom-hostname.png?fit=max&auto=format&n=m5bow_5L0NIiCspo&q=85&s=22aeec390bc73811864936a55ff054bd" alt="Add Hostname" width="1570" height="456" data-path="images/cdn/add-a-custom-hostname.png" />
    </Frame>

    <Note>
      The hostname must be fully configured on the Pull Zone before requesting a certificate.
    </Note>
  </Step>

  <Step title="Verify domain control">
    Prove you control the hostname using **one** of the methods below. Choose **DNS** if you can edit your domain's DNS records, or **HTTP** if you can place a file on the server your domain currently points to. HTTP validation does not support wildcard hostnames, and only one verification (DNS or HTTP) can be pending per hostname at a time.

    <Tabs>
      <Tab title="DNS (TXT record)">
        <Steps>
          <Step title="Request the certificate">
            Initiate certificate issuance using DNS validation:

            ```bash theme={null}
            curl --request POST \
              --url https://api.bunny.net/pullzone/{id}/requestExternalDnsCertificate \
              --header 'AccessKey: YOUR_API_KEY' \
              --header 'Content-Type: application/json' \
              --data '
            {
              "Hostname": "cdn.example.com"
            }
            '
            ```

            This request returns the DNS TXT record required for domain verification.

            <Card title="API Reference" href="https://docs.bunny.net/api-reference/core/pull-zone/request-external-dns-certificate">
              View full endpoint documentation
            </Card>
          </Step>

          <Step title="Create the DNS TXT record">
            Add the returned TXT record to your domain’s DNS zone.

            Example:

            ```bash theme={null}
            _acme-challenge.example.com  TXT  "verification-token"
            ```

            Wait until the record is publicly resolvable before continuing.
          </Step>

          <Step title="Complete issuance">
            Finalize the process once the TXT record is live:

            ```bash theme={null}
            curl --request POST \
              --url https://api.bunny.net/pullzone/{id}/completeExternalDnsCertificate \
              --header 'AccessKey: YOUR_API_KEY' \
              --header 'Content-Type: application/json' \
              --data '
            {
              "Hostname": "cdn.example.com"
            }
            '
            ```

            This validates the DNS record and issues the certificate.

            <Card title="API Reference" href="https://docs.bunny.net/api-reference/core/pull-zone/complete-external-dns-certificate">
              View full endpoint documentation
            </Card>
          </Step>
        </Steps>
      </Tab>

      <Tab title="HTTP (file)">
        <Steps>
          <Step title="Request the certificate">
            Initiate certificate issuance using HTTP validation:

            ```bash theme={null}
            curl --request POST \
              --url https://api.bunny.net/pullzone/{id}/requestExternalHttpCertificate \
              --header 'AccessKey: YOUR_API_KEY' \
              --header 'Content-Type: application/json' \
              --data '
            {
              "Hostname": "cdn.example.com"
            }
            '
            ```

            This request returns the challenge file's path and its contents (`FilePath` and `FileContent`).

            <Card title="API Reference" href="https://docs.bunny.net/api-reference/core/pull-zone/request-external-http-certificate">
              View full endpoint documentation
            </Card>
          </Step>

          <Step title="Host the challenge file">
            On the server your domain **currently** points to, serve the returned `FileContent` at the returned `FilePath` so it is reachable over plain HTTP (port 80):

            ```text theme={null}
            http://cdn.example.com/.well-known/acme-challenge/<token>
            ```

            The response body must exactly match the `FileContent` value from the previous step. Redirects to HTTPS are followed during validation.
          </Step>

          <Step title="Complete issuance">
            Finalize the process once the file is reachable:

            ```bash theme={null}
            curl --request POST \
              --url https://api.bunny.net/pullzone/{id}/completeExternalHttpCertificate \
              --header 'AccessKey: YOUR_API_KEY' \
              --header 'Content-Type: application/json' \
              --data '
            {
              "Hostname": "cdn.example.com"
            }
            '
            ```

            This fetches the challenge file and issues the certificate.

            <Card title="API Reference" href="https://docs.bunny.net/api-reference/core/pull-zone/complete-external-http-certificate">
              View full endpoint documentation
            </Card>
          </Step>
        </Steps>
      </Tab>
    </Tabs>
  </Step>

  <Step title="Update DNS to use your Pull Zone hostname">
    After the certificate is issued, update your domain’s DNS records to point to your Pull Zone hostname (e.g., `yourzone.b-cdn.net`).

    * Use a **CNAME record** for subdomains (e.g., `cdn.example.com`)
    * Use an **ALIAS/ANAME record** if configuring an apex/root domain

    HTTPS will be available immediately after traffic is switched.
  </Step>

  <Step title="Automatic renewal">
    After the initial issuance:

    * Certificates automatically switch to **HTTP-01 validation**
    * Renewals happen automatically
    * No further DNS changes are required
  </Step>
</Steps>

<Note>
  * For **DNS** validation, the TXT record must be publicly resolvable before completing the request; propagation time depends on your DNS provider
  * For **HTTP** validation, the challenge file must be reachable over plain HTTP (port 80) on the server your domain currently points to, and wildcard hostnames are not supported
  * Only one verification (DNS or HTTP) can be pending per hostname at a time; starting a new request replaces any previous pending one
  * Certificate issuance depends on successful validation by the certificate authority
</Note>