On-demand TLS authorization (BLE-1356): the edge (Caddy on_demand_tls "ask",
Dahili
or an ACME controller) calls this BEFORE issuing a certificate for an incoming
SNI host. We return 200 only for a domain that maps to an ACTIVE tenant custom
domain — so an attacker can't point an arbitrary host at us to mint certs or burn
the ACME rate limit. Reuses the same resolve_domain lookup as edge routing.
(Restrict to edge IPs at the network layer in production.)
İstek
curl -X GET "https://api.blesyum.com/internal/tls-authorize" \
-H "X-Blesyum-Internal: <imza>" \
-H "Accept: application/json"Yanıt
{
"data": "…",
"trace_id": "01JC…"
}