Enable HTTPS encrypted access

Limitations

• The following table describes the limitations of enabling HTTPS encrypted access for different Web Hosting instance types.

  Type	HTTPS support	Description
  exclusive web hosting	Supported	If you bind multiple domain names to your Web Hosting instance, the restrictions for enabling HTTPS vary by instance type. Web Hosting instances that run a non-enhanced edition of Windows: You can enable HTTPS encrypted access for only one domain name at a time. To enable HTTPS for a different domain name, you must first disable it for the current one. Web Hosting instances that run an enhanced edition of Windows: You can enable HTTPS encrypted access for multiple domain names simultaneously. Web Hosting instances that run Linux: Both enhanced and non-enhanced editions support enabling HTTPS encrypted access for multiple domain names simultaneously.
  shared web hosting	Supported on Linux-based Web Hosting instances (except for those in the Beijing BGP data center). Not supported on Windows-based Web Hosting instances.	All Linux-based shared web hosting instances, except for those in the Beijing BGP data center, support enabling HTTPS encrypted access for multiple domain names simultaneously. If you need to enable HTTPS on a shared web hosting instance that runs Windows, you can upgrade to or replace it with an exclusive web hosting instance that runs Windows. For more information, see Upgrade Web Hosting or Migrate Websites Between Hosts (Across Different Accounts).

  Important

  Web Hosting instances for URL forwarding and Java applications do not support HTTPS encrypted access.

  Note

  In multi-domain scenarios, the HTTPS configuration for each domain is independent. Enabling HTTPS for one domain does not automatically affect the access protocol of other domains. You must apply for a matching certificate for each domain and enable HTTPS encrypted access separately for each one.

• The following table lists the TLS protocol versions supported by different operating systems on Web Hosting instances.

  Operating system	Supported protocol versions
  Windows	TLS 1.0, TLS 1.1, TLS 1.2
  Linux	TLS 1.1, TLS 1.2

Usage notes

• A Cloud Shield certificate is associated with an Alibaba Cloud account. Therefore, the method to enable HTTPS varies depending on how you log on to the Web Hosting console.

  Logon method	Cloud Shield certificate support	Custom certificate support
  Log on with an Alibaba Cloud account	Yes	Yes
  Log on with a console username and password	No	Yes

  Note

  If you log on to the Web Hosting console with a username and password and go to the HTTPS Encrypted Access page, the Cloud Shield Certificate option next to Certificate Type is grayed out. This indicates that your current logon method does not support enabling HTTPS with a Cloud Shield certificate.

• If you have configured a 301 redirect for a domain name without enabling HTTPS, enabling HTTPS later may cause the redirect to fail.

  For example, an apex domain might fail to redirect to its www subdomain after a 301 redirect is configured. To fix this, you must reconfigure the 301 redirect for the domain name. For more information, see Set up a 301 redirect.

Procedure

1. Log on to the Cloud Web Hosting management page.
2. Find the Cloud Web Hosting instance you want to manage and click Manage in the Actions column.
3. In the navigation pane on the left, choose Domain Management > Domain Binding.

4. On the Domain Binding page, find the domain name, and click Enable in the Force HTTPS column.

5. Choose a certificate type and enable HTTPS encrypted access.

   Enabling HTTPS encrypted access requires Certificate Management Service (formerly SSL Certificates). Web Hosting supports two types of certificates: Cloud Shield Certificate and Custom Certificate. The procedure depends on the certificate type.

   Cloud Shield certificate

   To use a Cloud Shield certificate, you must first apply for one in the Certificate Management Service console. For more information, see Details of personal trial certificates and commercial certificates.

   1. On the HTTPS Encrypted Access page, click the Cloud Shield Certificate tab.

   2. In the Select a certificate list, select the Cloud Shield certificate for the target domain name.

      Note

      Web Hosting fetches and deploys the certificate you select from Certificate Management Service.

      Cloud Shield certificates include personal trial certificates and commercial certificates. The following table describes the details.

      Certificate type	Application link	Description
      personal trial certificate	Apply for a personal trial certificate	Each Alibaba Cloud root account that has completed real-name registration is eligible for 20 free personal trial certificates from Certificate Management Service per calendar year. For more information, see Personal trial certificates. After obtaining a free personal trial certificate, you must submit an application in the Certificate Management Service console. The Certificate Authority (CA) will issue the certificate after reviewing and approving your application. For more information, see Apply for a personal trial certificate. Important Web Hosting stopped proxying applications for free personal trial certificates on November 30, 2022. For more information, see [Announcement] Web Hosting Stops Proxying Applications for Free Personal Trial Certificates.
      commercial certificate	Apply for a commercial certificate	Compared with free personal trial certificates, commercial certificates offer higher security levels, better compatibility with various runtime environments, and access to assisted customer support. For more information, see Upgrade a personal trial certificate. Before you use a Cloud Shield certificate to enable HTTPS, you must first purchase and apply for an SSL certificate in the Certificate Management Service console. For more information, see Purchase a commercial certificate and Submit a certificate application.

      Note

      When you use Cloud Shield certificates, note the following:

      • Certificate management: You can log on to the Certificate Management Service console to view your applied or purchased Cloud Shield certificates. The certificate list in the Web Hosting console only displays certificates associated with the current Alibaba Cloud account.

      • Logon method restriction: If you log on to the Web Hosting console with a console username and password, Cloud Shield certificates are unavailable. You can only use a Custom Certificate to enable HTTPS.

      • Free certificate application: Personal trial certificates (free) must be applied for and issued in the Certificate Management Service console before they appear in the Web Hosting certificate list. Web Hosting stopped proxying applications for free personal trial certificates on November 30, 2022.

      • Cannot find a purchased certificate: If a purchased certificate does not appear in the certificate list, verify that you are logged in with the same Alibaba Cloud account that was used to purchase the certificate.

   3. Click Confirm.

      HTTPS encrypted access is successfully enabled with the Cloud Shield certificate.

      Return to the Domain Binding page. The status in the Force HTTPS column for the target domain name changes to Enabled (Cloud Shield Certificate).

   Custom certificate

   Before you use a custom certificate to enable HTTPS encrypted access, make sure you have the certificate and its private key available locally. For example, you can download the certificate from the Certificate Management Service console to your local host and then view the PEM-formatted certificate file. For more information, see Deploy an SSL certificate.

   1. On the HTTPS Encrypted Access page, click the Custom Certificate tab.

   2. Enter the certificate content and private key content, and then click Confirm.

      • In the Certificate Content (PEM-encoded example) field, paste the content of your certificate file.

      • In the Private Key Content (PEM-encoded example) field, paste the content of your private key file.

      Note

      You can hover over the icon to view an example.

      Once the custom certificate content is verified, HTTPS is enabled immediately.

      Note

      When you upload a custom certificate, note the following:

      • Certificate format: Web Hosting only supports certificates in Nginx format (PEM-encoded). Make sure you download the certificate in the correct format from the Certificate Management Service console before uploading. For more information, see Deploy an SSL certificate.

      • Private key password: If you are prompted for a password when entering the private key content, this is the password you set when applying for or exporting the certificate. The system does not store this password. If you have forgotten it, contact your certification authority (CA) or re-export the certificate without password protection.

      • Deployment failure: If the certificate content does not match the private key, or if the certificate format is incorrect, HTTPS deployment fails. Use a Cloud Shield Certificate for one-click deployment to avoid format issues that may arise from manual upload.

FAQ

Why doesn't the security lock icon appear in my browser after I enable HTTPS?

When HTTPS is enabled, your browser displays a security lock icon in the address bar.

If the browser does not show the security lock icon, it is usually because the page loads mixed content, with some resources served over HTTP. For example, the page might load external images or stylesheets over HTTP. To ensure the browser displays the security lock icon, you must convert all content on your website to use HTTPS.

How do I renew or replace an expired SSL certificate?

Web Hosting does not support directly overwriting a deployed certificate. You must first disable HTTPS for the target domain and then re-enable it with the new certificate. Perform the following steps:

1. On the Domain Binding page, find the target domain name and click Disable in the Force HTTPS column.

2. After HTTPS is disabled, click Enable again to go to the HTTPS Encrypted Access page.

3. Select one of the following deployment methods based on your new certificate type:

   • Cloud Shield Certificate: Click the Cloud Shield Certificate tab, select the renewed or newly applied certificate from the list, and click Confirm.

   • Custom Certificate: Click the Custom Certificate tab, paste the PEM content of the new certificate and the corresponding private key content, and click Confirm.

4. After deployment, visit the domain name in a browser and verify that the security lock icon appears in the address bar, indicating that HTTPS is working properly.

Related topics

On enhanced, Linux-based Web Hosting instances, if HTTPS is enabled for both the source and destination domain names, you can choose to enable or disable HTTPS redirection. For more information, see Enable or disable HTTPS redirection.