Enable HTTPS encrypted access

Limitations

• The following table describes the limitations of enabling HTTPS encrypted access for different Web Hosting instance types.

  Type	HTTPS support	Description
  exclusive web hosting	Supported	If you bind multiple domain names to your Web Hosting instance, the restrictions for enabling HTTPS vary by instance type. Web Hosting instances that run a non-enhanced edition of Windows: You can enable HTTPS encrypted access for only one domain name at a time. To enable HTTPS for a different domain name, you must first disable it for the current one. Web Hosting instances that run an enhanced edition of Windows: You can enable HTTPS encrypted access for multiple domain names simultaneously. Web Hosting instances that run Linux: Both enhanced and non-enhanced editions support enabling HTTPS encrypted access for multiple domain names simultaneously.
  shared web hosting	Supported on Linux-based Web Hosting instances (except for those in the Beijing BGP data center). Not supported on Windows-based Web Hosting instances.	All Linux-based shared web hosting instances, except for those in the Beijing BGP data center, support enabling HTTPS encrypted access for multiple domain names simultaneously. If you need to enable HTTPS on a shared web hosting instance that runs Windows, you can upgrade to or replace it with an exclusive web hosting instance that runs Windows. For more information, see Upgrade Web Hosting or Migrate Websites Between Hosts (Across Different Accounts).

  Important

  Web Hosting instances for URL forwarding and Java applications do not support HTTPS encrypted access.

• The following table lists the TLS protocol versions supported by different operating systems on Web Hosting instances.

  Operating system	Supported protocol versions
  Windows	TLS 1.0, TLS 1.1, TLS 1.2
  Linux	TLS 1.1, TLS 1.2

Usage notes

• A Cloud Shield certificate is associated with an Alibaba Cloud account. Therefore, the method to enable HTTPS varies depending on how you log on to the Web Hosting console.

  Logon method	Cloud Shield certificate support	Custom certificate support
  Log on with an Alibaba Cloud account	Yes	Yes
  Log on with a console username and password	No	Yes

  Note

  If you log on to the Web Hosting console with a username and password and go to the HTTPS Encrypted Access page, the Cloud Shield Certificate option next to Certificate Type is grayed out. This indicates that your current logon method does not support enabling HTTPS with a Cloud Shield certificate.

• If you have configured a 301 redirect for a domain name without enabling HTTPS, enabling HTTPS later may cause the redirect to fail.

  For example, an apex domain might fail to redirect to its www subdomain after a 301 redirect is configured. To fix this, you must reconfigure the 301 redirect for the domain name. For more information, see Set up a 301 redirect.

Procedure

1. Log on to the Cloud Web Hosting management page.
2. Find the Cloud Web Hosting instance that you want to manage and click Manage in the Actions column.
3. In the navigation pane on the left, choose Domain Name Management > Domain Name Binding.

4. On the Domain Binding page, find the domain name, and click Enable in the Force HTTPS column.

5. Choose a certificate type and enable HTTPS encrypted access.

   Enabling HTTPS encrypted access requires Certificate Management Service (formerly SSL Certificates). Web Hosting supports two types of certificates: Cloud Shield Certificate and Custom Certificate. The procedure depends on the certificate type.

   Cloud Shield certificate

   To use a Cloud Shield certificate, you must first apply for one in the Certificate Management Service console. For more information, see Details of personal trial certificates and commercial certificates.

   1. On the HTTPS Encrypted Access page, click the Cloud Shield Certificate tab.

   2. In the Select a certificate list, select the Cloud Shield certificate for the target domain name.

      Note

      Web Hosting fetches and deploys the certificate you select from Certificate Management Service.

      Cloud Shield certificates include personal trial certificates and commercial certificates. The following table describes the details.

      Certificate type	Application link	Description
      personal trial certificate	Apply for a personal trial certificate	Each Alibaba Cloud root account that has completed real-name registration is eligible for 20 free personal trial certificates from Certificate Management Service per calendar year. For more information, see Personal trial certificates. After obtaining a free personal trial certificate, you must submit an application in the Certificate Management Service console. The Certificate Authority (CA) will issue the certificate after reviewing and approving your application. For more information, see Apply for a personal trial certificate. Important Web Hosting stopped proxying applications for free personal trial certificates on November 30, 2022. For more information, see [Announcement] Web Hosting Stops Proxying Applications for Free Personal Trial Certificates.
      commercial certificate	Apply for a commercial certificate	Compared with free personal trial certificates, commercial certificates offer higher security levels, better compatibility with various runtime environments, and access to assisted customer support. For more information, see Upgrade a personal trial certificate. Before you use a Cloud Shield certificate to enable HTTPS, you must first purchase and apply for an SSL certificate in the Certificate Management Service console. For more information, see Purchase a commercial certificate and Submit a certificate application.

   3. Click Confirm.

      HTTPS encrypted access is successfully enabled with the Cloud Shield certificate.

      Return to the Domain Binding page. The status in the Force HTTPS column for the target domain name changes to Enabled (Cloud Shield Certificate).

   Custom certificate

   Before you use a custom certificate to enable HTTPS encrypted access, make sure you have the certificate and its private key available locally. For example, you can download the certificate from the Certificate Management Service console to your local host and then view the PEM-formatted certificate file. For more information, see Deploy an SSL certificate.

   1. On the HTTPS Encrypted Access page, click the Custom Certificate tab.

   2. Enter the certificate content and private key content, and then click Confirm.

      • In the Certificate Content (PEM-encoded example) field, paste the content of your certificate file.

      • In the Private Key Content (PEM-encoded example) field, paste the content of your private key file.

      Note

      You can hover over the icon to view an example.

      Once the custom certificate content is verified, HTTPS is enabled immediately.

FAQ

Why doesn't the security lock icon appear in my browser after I enable HTTPS?

When HTTPS is enabled, your browser displays a security lock icon in the address bar.

If the browser does not show the security lock icon, it is usually because the page loads mixed content, with some resources served over HTTP. For example, the page might load external images or stylesheets over HTTP. To ensure the browser displays the security lock icon, you must convert all content on your website to use HTTPS.

Related topics

On enhanced, Linux-based Web Hosting instances, if HTTPS is enabled for both the source and destination domain names, you can choose to enable or disable HTTPS redirection. For more information, see Enable or disable HTTPS redirection.