Webhook 定义

当您为 SSL for SaaS Custom Hostnames 创建 webhook 通知时，可能希望针对特定事件（证书签发、验证失败等）实现自动化响应。

以下部分详细说明 Cloudflare 发送到 webhook 目标的数据。

证书验证

在证书颁发机构为域名签发证书之前，请求者必须证明其对该域名拥有控制权。此过程称为域名控制验证 (DCV)。

验证成功

当证书状态从 pending_validation 变为 pending_issuance 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.validation.succeeded",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_issuance",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

验证失败

在 DCV 重试期间，每当证书仍处于 pending_validation 状态时，Cloudflare 都会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.validation.failed",
      "created_at": "2018-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_validation",
      "cname": "_ca3-64ce913ebfe74edeb2e8813e3928e359.app.example2.com",
      "cname_target": "dcv.digicert.com",
      "validation_errors": [
        {
          "message": "blog.example.com reported as potential risk: google_safe_browsing"
        }
      ],
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

证书签发

验证通过后，Cloudflare 会与您选择的证书颁发机构配合签发证书。

签发成功

当证书状态从 pending_validation 或 pending_issuance 变为 pending_deployment 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.issuance.succeeded",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_deployment",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

签发失败

在 DCV 重试期间，每当证书仍处于 pending_issuance 状态时，Cloudflare 都会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.issuance.failed",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_issuance",
      "cname": "_ca3-64ce913ebfe74edeb2e8813e3928e359.app.example2.com",
      "cname_target": "dcv.digicert.com",
      "validation_errors": [
        {
          "message": "caa_error: blog.example.com"
        }
      ],
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

证书部署

签发后，证书会部署到 Cloudflare 的全球边缘网络。

部署成功

当证书状态从 pending_deployment 变为 active 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.deployment.succeeded",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "active",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

部署失败

在 DCV 重试期间，每当证书仍处于 pending_deployment 状态时，Cloudflare 都会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.deployment.failed",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_deployment",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

证书删除

删除成功

当证书状态从 pending_deletion 变为 deleted 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.deletion.succeeded",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "deleted"
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

删除失败

在 DCV 重试期间，每当证书仍处于 pending_deletion 状态时，Cloudflare 都会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.deletion.failed",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_deletion"
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

证书续订

签发后，证书的有效期取决于证书颁发机构。

续订证书所需执行的操作取决于您的验证方法。

即将续订

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.renewal.upcoming_certificate_expiration_notification",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "status": "active",
      "hosts": ["blog.example.com"],
      "issuer": "DigiCertInc",
      "serial_number": "1001172778337169491",
      "signature": "ECDSAWithSHA256",
      "uploaded_on": "2021-11-17T04:33:54.561747Z",
      "expires_on": "2022-11-21T12:00:00Z",
      "custom_csr_id": "7b163417-1d2b-4c84-a38a-2fb7a0cd7752",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

续订成功

当证书状态从 active 变为 pending_deployment 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.renewal.succeeded",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_deployment",
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

续订失败

当证书状态从 active 变为 pending_issuance 时，Cloudflare 会发送此警报。

{
  "metadata": {
    "event": {
      "id": "<<WEBHOOK_ID>",
      "type": "ssl.custom_hostname_certificate.renewal.failed",
      "created_at": "2022-02-09T00:03:28.385080Z"
    },
    "account": {
      "id": "<<ACCOUNT_ID>"
    },
    "zone": {
      "id": "<<ZONE_ID>"
    }
  },
  "data": {
    "id": "<<CUSTOM_HOSTNAME_ID>",
    "hostname": "blog.com",
    "ssl": {
      "id": "<<CERTIFICATE_ID>",
      "type": "dv",
      "method": "cname",
      "status": "pending_issuance",
      "cname": "_ca3-64ce913ebfe74edeb2e8813e3928e359.app.example2.com",
      "cname_target": "dcv.digicert.com",
      "validation_errors": [
        {
          "message": "caa_error: blog.example.com"
        }
      ],
      "settings": {
        "min_tls_version": "1.2",
        "http2": "on"
      }
    },
    "custom_metadata": {
      "key1": "value1",
      "key2": "value2"
    },
    "custom_origin_server": "0001.blog.com"
  }
}

故障排除

偶尔，您可能会看到 webhook 通知中不包含对应的 <<CUSTOM_HOSTNAME_ID>> 和 hostname 值。

出现此行为是因为每个自定义主机名只能附加一张证书。先前附加的证书仍可能发出 webhook 事件，但不会包含关联的主机名和 ID 值。

警报

您可以配置警报，以在自定义主机名证书发生变更时接收通知。

SSL for SaaS Custom Hostnames Alert

Who is it for?

Customers with custom hostname certificates who want to receive a notification on validation, issuance, renewal, and expiration of certificates. For more details around data formatting for webhooks, refer to the Cloudflare for SaaS docs.

Other options / filters

None.

Included with

Purchase of Cloudflare for SaaS.

What should you do if you receive one?

You only need to take action if you are notified that you have a certificate that failed. You can find the reasons why a certificate is not being issued in Troubleshooting SSL errors.

有关如何设置警报的更多信息，请参阅 Cloudflare Notifications。