Configure an HTTPS certificate

Scope

Before you configure a certificate, review the following feature boundaries and constraints to ensure successful deployment:

• Purchase a certificate: If you do not have a certificate, you can apply for a personal test certificate (formerly a free certificate) or purchase an official certificate in the Certificate Management Service console.

• Private key requirements: If you choose to upload a custom certificate, the private key of the uploaded certificate must not be password-protected. First verify that password protection is removed from the private key file.

• SM certificate (SM2): The CDN console does not support direct configuration of SM2 dual-certificate setups. To use an SM certificate, you must configure it using the SetCdnDomainSMCertificate API operation.

Configure via console

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the domain's navigation pane, click HTTPS.

5. In the HTTPS Certificate section, click Modify.

6. On the Modify HTTPS Settings page, turn on the HTTPS Secure Acceleration switch, and configure certificate parameters. Enabling HTTPS Secure Acceleration incurs charges based on the number of HTTPS requests.

   • If you have purchased a certificate in Certificate Management Service, select Certificate Management Service and choose the purchased certificate from the Certificate Name drop-down list. Certificates purchased in Certificate Management Service can be deployed to the CDN platform in batches. For more information, see Deploy an SSL certificate to multiple domain names.

     Note

     If you cannot find your certificate, make sure the domain name bound to the certificate is identical to the accelerated domain name.

   • If you are using a certificate from a third-party provider, select Custom Certificate (Certificate+Private Key). You must then specify a Certificate Name and paste the content of your Certificate (Public Key) and Private Key. The certificate is saved to Alibaba Cloud Certificate Management Service and can be viewed on the My Certificates page.

     The Custom Upload feature has strict format requirements for the Certificate (Public Key) and Private Key. If you encounter configuration errors or do not understand the configuration examples, you can refer to Upload a custom certificate to process the Certificate (Public Key) and Private Key, and then upload them.

     Parameter	Description
     Certificate Name	Enter a name for the certificate to be uploaded. The name can contain only letters, periods (.), digits, underscores (_), and hyphens (-). The name must be unique.
     Certificate (Public Key)	Enter the PEM-encoded content of the certificate file content in Step 1.
     Private Key	Enter the PEM-encoded content of the private key in Step 1. Because private key information is sensitive, it cannot be viewed or exported from the console after it is uploaded. Keep the private key properly stored locally.

7. Click OK.

Configure via API or CLI

You can call the SetCdnDomainSSLCertificate API operation.

The following is an example of the command if you use Alibaba Cloud CLI:

aliyun cdn set-cdn-domain-ssl-certificate \
  --domain-name <your_accelerated_domain_name> \
  --cert-name <certificate_name> \
  --cert-id <certificate_ID> \
  --cert-type cas \
  --ssl-protocol on \
  --region cn-hangzhou

To upload a custom certificate, you must specify the ssl-pub (public key) and ssl-pri (private key) parameters, and set the cert-type parameter to upload. The following is an example of the command:

aliyun cdn set-cdn-domain-ssl-certificate \
  --domain-name example.com \
  --cert-name yourCertName \
  --cert-type upload \
  --ssl-protocol on \
  --ssl-pub "<PEM-encoded_public_key_content>" \
  --ssl-pri "<PEM-encoded_private_key_content>" \
  --region cn-hangzhou

Upload a custom certificate

If you have a certificate issued by a third-party provider or a self-signed certificate, you must prepare the certificate and private key in a supported format before you upload them.

• Certificate (public key)

  CDN supports only PEM-format certificates. To convert other formats, see Convert the format of a certificate. Upload requirements vary by certificate authority (CA):

  • Certificates issued by a root CA (one certificate file)

    Open the PEM certificate file in a text editor. Upload the entire content, including the lines that start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

    -----BEGIN CERTIFICATE-----
    [Certificate content]
    -----END CERTIFICATE-----

  • Certificates issued by an intermediate CA (multiple certificate files)
    Concatenate the server certificate and all intermediate CA certificates in order into a single certificate chain file. The file content must follow this format:
    

    -----BEGIN CERTIFICATE-----
    [Server certificate content]
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    [Intermediate CA certificate content]
    -----END CERTIFICATE-----

• Private key
  The file extension for a private key is typically .key or .pem. Open the private key file in a text editor. The upload requirements differ for various private key formats:
  

  • Upload an RSA private key directly

    If the private key starts with -----BEGIN RSA PRIVATE KEY----- and ends with -----END RSA PRIVATE KEY-----, upload the private key content directly.

    -----BEGIN RSA PRIVATE KEY-----
    [Private key content]
    -----END RSA PRIVATE KEY-----

  • Convert other private key formats before uploading

    If your private key starts with -----BEGIN PRIVATE KEY----- and ends with -----END PRIVATE KEY-----, first convert the key using an OpenSSL command. Then, upload the content of the converted private key as described in the Upload an RSA private key directly section. In the command, old_server_key.pem is the original private key and new_server_key.pem is the converted private key.

    # Private key to be converted
    -----BEGIN PRIVATE KEY-----
    [Private key content]
    -----END PRIVATE KEY-----

    # Conversion command
    openssl rsa -in old_server_key.pem -out new_server_key.pem

  • When you download or apply for a certificate from a third-party provider, pay attention to the following file distinctions:

    • Typically, the .pem or .crt file contains the public key (certificate content), and the .key or .private file contains the private key.

    • When uploading, paste the content of the public key file (.pem or .crt) into the "certificate (public key)" field, and the content of the private key file (.key or .private) into the "private key" field.

    • Do not upload a CSR file. A Certificate Signing Request (CSR) is used only to apply for a certificate from a certificate authority and cannot be used as a certificate or a private key.

    • If you are using a certificate in Nginx format, ensure the following:

      1. The certificate file content is in PEM format and starts with -----BEGIN CERTIFICATE-----.

      2. The private key file content is in PEM format and starts with -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PRIVATE KEY-----.

      3. The certificate and private key match.

      4. Remove any extra spaces, line breaks, or non-standard characters from the files.

    • If the certificate chain is incomplete, you must combine the intermediate certificate with the primary certificate in a single file before uploading. For more information, see Certificate format.

Verify the HTTPS configuration

• Browser verification: Access https://your-accelerated-domain-name in a browser. A lock icon in the address bar with valid certificate details indicates that the configuration is successful.

• Command-line verification: Run curl -I https://your-accelerated-domain-name. A 200 status code confirms the HTTPS service is active.

Disable HTTPS acceleration

You can disable it at any time in the CDN console. The change takes effect immediately. After the feature is disabled, clients can no longer access resources over HTTPS, and the certificate and private key information is removed.

To re-enable HTTPS secure acceleration, select and configure a certificate again.

Billing

Enabling HTTPS Secure Acceleration incurs additional fees.

• Billable item: Static HTTPS requests. This fee is separate from CDN data transfer fees and is based on the total number of static HTTPS requests across all accelerated domain names under your account.

• Billing methods: Both pay-as-you-go and subscription by purchasing a resource plan for static HTTPS requests are supported.

• Cost notice:

  • CDN data transfer plans cannot be used to offset charges for HTTPS requests.

  • Purchased resource plans for static HTTPS requests can be shared between CDN and DCDN.

References

Related APIs