Terraform configuration FAQ

How do I configure a certificate when creating a CDN accelerated domain name?

Set the alicloud_cdn_domain_newcertificate_config block inside the alicloud_cdn_domain_new resource. The block supports two certificate sources — use cert_type = "cas" to reference a certificate from Certificate Management Service, or cert_type = "upload" to supply the certificate content directly.

resource "alicloud_cdn_domain_new" "domain" {
  scope       = "overseas"
  domain_name = "mycdndomain-${random_integer.default.result}.alicloud-provider.cn"
  cdn_type    = "download"
  sources {
    type     = "ipaddr"
    content  = "1.1.x.x"
    priority = 20
    port     = 80
    weight   = 15
  }
  certificate_config {
    server_certificate_status = "on"
    cert_type                 = "cas"
    cert_id                   = "1111111"
    cert_region               = "cn-hangzhou"
  }
}

resource "alicloud_cdn_domain_new" "domain" {
  scope       = "overseas"
  domain_name = "mycdndomain-${random_integer.default.result}.alicloud-provider.cn"
  cdn_type    = "download"
  sources {
    type     = "ipaddr"
    content  = "1.1.x.x"
    priority = 20
    port     = 80
    weight   = 15
  }
  certificate_config {
    server_certificate_status = "on"
    cert_type                 = "upload"
    cert_name                 = "cert-xxxxxxxxx"
    server_certificate        = "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
    private_key               = "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
  }
}

Does the certificate enable automatically after configuration?

Yes. Including the certificate_config block sets server_certificate_status = "on" by default. No additional steps are needed.

What are the supported values for cert_type?

Two values are supported:

• upload — supply the certificate content directly. Requires server_certificate (public key in PEM format) and private_key (private key in PEM format). Specify this or cas.

• cas — reference an SSL certificate from Certificate Management Service. Requires cert_id and cert_region. Specify this or upload.

The free certificate type is no longer supported.

What parameters are required when cert_type is upload?

Provide the following parameters in PEM format:

certificate_config {
  cert_type          = "upload"
  cert_name          = "cert-xxxxxxxxx"
  server_certificate = "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
  private_key        = "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
}

What parameters are required when cert_type is cas?

Provide the following parameters:

certificate_config {
  server_certificate_status = "on"
  cert_type                 = "cas"
  cert_id                   = "1111111"
  cert_region               = "cn-hangzhou"
}

What does cert_region do and how do I set it?

cert_region identifies which regional instance of Certificate Management Service holds your certificate. It is required when cert_type = "cas".

Set it based on the account that owns the certificate: