Zebra Weblink Certificate Deployment via ~DYE

Zebra Weblink / Cloud Connect

Weblink (Zebra's newer name: Cloud Connect) is the HTTPS/WebSocket client built into the Link-OS firmware of ZT, ZD and ZQ printers. The printer connects outbound to the URL stored in one of two slots (weblink.ip.conn1.location / weblink.ip.conn2.location) and keeps that connection open. Print jobs, SGD commands and configuration travel over it; no inbound port is needed.

zplCloud's relay endpoints are weblink.zplcloud.com (production) and weblink.test.zplcloud.com (test stage). For TLS the printer needs three files per domain + printer, generated in the platform (Certificates tab) or via POST /api/certificates/generate: WEBLINK2_CA.NRD, WEBLINK2_CERT.NRD, WEBLINK2_KEY.NRD. The deploy script installs exactly these files and sets slot 2.

What the script does

Downloads the three NRD files (API key protected) for domain + printer.
Deletes existing files on the printer (SGD file.delete).
Uploads them via ~DYE over TCP 9100.
Sets weblink.ip.conn2.location, NTP server, timezone and RTC date/time.
Resets the printer (device.reset) to activate the configuration.

This changes printer configuration

The script writes certificates to printer memory, sets SGD variables (Weblink URL, NTP, RTC) and restarts the printer. Run it only on printers you own or are authorised to configure, check the parameters first, back up the configuration (! U1 getvar "allcv") and test on one device before rolling out. Network and firmware changes are your responsibility (Terms, section 14.3).

Prerequisites

Certificates for the printer generated in zplCloud (Certificates tab or POST /api/certificates/generate).
API key with access to the domain.
Printer reachable on TCP 9100 (IP or hostname).

Parameters

Parameter	Required	Meaning
hostname	yes	Printer name; selects the NRD storage (domain folder) and is the default TCP target.
apikey	yes	API key; authorises the NRD download. Validated server-side - without a valid key the script is not served.
ip	no	TCP target (IPv4 or hostname) if it differs from `hostname`. Hostname not resolving on your network? No problem - just deploy with the IP; `hostname` still selects the certificate.

Windows - PowerShell 5.1+

irm "https://zplcloud.com/weblink-deploy.ps1?hostname=printer01&apikey=sk_zplcloud_XXXX" | iex
# explicit TCP target:
irm "https://zplcloud.com/weblink-deploy.ps1?hostname=printer01&apikey=sk_zplcloud_XXXX&ip=10.0.0.5" | iex

macOS / Linux / Raspberry Pi - bash

Needs bash and curl or wget; uses /dev/tcp for the TCP connection and mktemp for temporary files. x64 and arm64.

curl -fsSL "https://zplcloud.com/weblink-deploy.sh?hostname=printer01&apikey=sk_zplcloud_XXXX" | bash
# explicit TCP target:
curl -fsSL "https://zplcloud.com/weblink-deploy.sh?hostname=printer01&apikey=sk_zplcloud_XXXX&ip=10.0.0.5" | bash

Both scripts are idempotent (old files are deleted before upload) and log every file and SGD response to the console; errors are printed as ERROR …. Alternative with the CLI: zplcloud weblink setup (see CLI), which also registers the printer serial and owner.

Sequence

1) Download NRD files
   GET {api}/api/certificates/deploy/domain/{domain}/printer/{printer}/WEBLINK2_CA.NRD?apikey=...
   GET .../WEBLINK2_CERT.NRD?apikey=...
   GET .../WEBLINK2_KEY.NRD?apikey=...

2) Delete old files
   ! U1 do "file.delete" "E:WEBLINK2_CA.NRD"   (and CERT / KEY)

3) Upload (~DYE, TCP 9100)
   ~DYE:WEBLINK2_CA.NRD,B,NRD,<len>,,  + file bytes
   (same for CERT and KEY)

4) Slot + clock
   setvar weblink.ip.conn2.location  {weblink-URL}
   setvar ip.ntp.enable on
   setvar ip.ntp.server  ptbtime1.ptb.de
   setvar rtc.time_zone  CET-1CEST,M3.5.0/2,M10.5.0/3
   setvar rtc.date / rtc.time  (from the executing machine)

5) Reset
   ! U1 do "device.reset" ""

Troubleshooting

No connection after reset: check TCP 9100 reachability, that the certificates exist for this hostname, and that the printer's clock is set (TLS validity).
Every SGD command must end with CRLF; the scripts do this. When testing manually (e.g. ~HS via a raw socket) append \r\n, otherwise the printer buffers the command and never answers.
Status of the connection: platform → Weblink tab (last connect, keepalive, IP).

Security and ownership

mTLS: the relay validates the printer's client certificate at the TLS handshake against the domain CA (printercerts registry). Unregistered or revoked certificates cannot connect.
Revoke by serial: POST /api/certificates/revoke-by-serial/{serial} revokes the certificate and blocks every printer provisioned with it (printers.blocked); the relay rejects it immediately.
Ownership: the printer belongs to the API key that generated the certificate (user / team / company) and is listed only there. zplcloud weblink setup additionally stores serial and owner, so replacement devices under the same certificate are tracked.