> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Serving a certificate

> Attaching a certificate to an HTTPS listener: multi-SNI, the default, and the two removals a listener refuses.

## Serving a certificate

Attach the certificate to an HTTPS listener by CRN:

```bash theme={null}
POST /v1/load-balancers/{id}/listeners/{listener_id}/certificates
{ "certificate_crn": "crn:certificate::my-account:certificate/prod-frontend",
  "is_default": true }
```

A listener can hold several certificates and picks one per connection by
matching the client's SNI against each certificate's SANs. The one marked
`is_default` is the fallback for a client whose SNI matches nothing, or that
sends no SNI at all. Setting a new default demotes the previous one in the same
transaction.

<Warning>
  Detaching a certificate is refused in two cases: removing the **last**
  certificate from an HTTPS listener, and removing the **current default**
  while other certificates are still attached. Promote a replacement first.
</Warning>

<Note>
  A certificate CRN ends in `certificate/<name>`, so the slash must be
  percent-encoded as `%2F` when it appears in a path segment. Sent raw, it
  addresses a different route that does not exist.
</Note>