enableWafSSL — Adding SSL to an existing site

If a Firewall & CDN has been added and provisioned without SSL, and an SSL certificate is added at a later time, then SSL support must be enabled for the Firewall & CDN product as well.

The enableWafSSL request triggers the site’s SSL validation step, similar to how it’s triggered when detected or forced during Firewall & CDN provisioning (see provisionAddon response for SSL sites).

As of September 12, 2026, newly provisioned Firewall & CDN sites use site-specific SSL certificates and CNAME-based domain validation by default.

The enableWafSSL method isn’t available on Basic or free Firewall & CDN products. Those products support uploading the origin site’s SSL certificate to the Firewall & CDN and route SSL requests to the site certificate. However, neither Firewall & CDN SSL certificates nor SSL validation are available on Basic/free Firewall & CDN subscriptions.

The API endpoint is:

https://api.sitelock.com/v1/partner

As of September 12, 2026, newly provisioned Firewall & CDN sites use site-specific SSL certificates and CNAME-based domain validation.

TXT-based SSL validation and shared SSL certificate workflows are no longer supported for newly provisioned sites.

Existing sites are not affected.

Request format

  • SiteLockOnlineRequest: This element is used to delineate the full API request.

    • authentication: The partner’s username, password, and branding.

      • username: The partner’s API username

      • password: The partner’s API password

    • enableWafSSL: The method name

      • site_id: The site ID for which to add SSL support

The waf_network_cert_type parameter is deprecated and should no longer be used. Newly provisioned Firewall & CDN sites use site-specific SSL certificates with CNAME-based domain validation by default.

Example request

<SiteLockOnlineRequest>
    <authentication>
        <user>Username</user>
        <password>Password</password>
    </authentication>
    <enableWafSSL>
        <site_id>1234567</site_id>
    </enableWafSSL>
</SiteLockOnlineRequest>

Response format

When a site with a provisioned Firewall & CDN has or adds an SSL certificate, an additional step is required to fully configure the Firewall & CDN. A certificate authority independently verifies that the user owns the domain for the site being provisioned.

To complete this process, a CNAME record must be added to the site’s DNS zone for domain validation.

This validation record must remain in place to support automated certificate renewal.

The validation CNAME record must remain in the DNS zone after SSL validation is completed.

This record is required for automated certificate renewal.

  • SiteLockOnlineResponse: This element is used to delineate the full API response.

    • enableWafSSL: The method name

      • dns_ssl_verify: The details of the request response

        • current_dns_record_value: This element is populated when an existing SSL validation record is present for the site.

        • current_status: The current status of the record for verification. This element is only populated if current_dns_record_value has a value.

        • dns_record_domain: The domain for which the verification record must be added.

        • dns_record_type: The type of DNS record to be added. The value returned is CNAME.

        • dns_record_value: The value to be placed into the record for verification.

      • original_dns: The site’s original DNS settings

        • orig_a_rec: The original value of the site’s A record as an IP address

        • orig_cname: The original value of any CNAME alias assigned to the site

      • ssl: Additional info about the SSL certificate on your site

        • cert_detected: The value can be either 0 or 1

          • 1: The SSL certificate was detected on your site.

          • 0: The SSL certificate wasn’t detected on your site.

      • state: The state of your Firewall & CDN activation

      • traffic_routing: The value can be 0 or 1

        • 1: Traffic is routed through Firewall & CDN.

        • 0 Traffic isn’t routed through Firewall & CDN.

      • waf_dns_manager: Replays data given to SiteLock by the partner

        • partner: The partner manages DNS updates to configure the Firewall & CDN.

        • customer: The user manages DNS updates to configure the Firewall & CDN.

      • will_retry: This element is present when an SSL certificate isn’t immediately detected on the site at the time of provisioning. This value is always set to 0 as SiteLock doesn’t try to discover SSL automatically. Call getAnpProvisioningStatus periodically (at 6-hour intervals) to check the status of the latest provisioning attempt as that triggers the SSL discovery process.

Example success response

<SiteLockOnlineResponse>
    <enableWafSSL>
        <dns_ssl_verify>
            <current_dns_record_value></current_dns_record_value>
            <current_status></current_status>
            <dns_record_domain>_delegate_validation.yourdomain.com</dns_record_domain>
            <dns_record_type>CNAME</dns_record_type>
            <dns_record_value>test.sitelockcdn.net</dns_record_value>
        </dns_ssl_verify>
        <original_dns>
            <orig_a_rec>10.10.10.127</orig_a_rec>
            <orig_cname>www.yourdomain.com</orig_cname>
        </original_dns>
        <ssl>
            <cert_detected>1</cert_detected>
            <cert_installed>0</cert_installed>
        </ssl>
        <state>pending-domain-validation</state>
        <status>ok</status>
        <traffic_routing>0</traffic_routing>
        <waf_dns_manager>partner</waf_dns_manager>
    </enableWafSSL>
</SiteLockOnlineResponse>

Example error response

<SiteLockOnlineResponse>
    <enableWafSSL>
        <error code="4205">Site does not have SSL</error>
    </enableWafSSL>
</SiteLockOnlineResponse>