Bind multiple certificates to an HTTPS listener-Global Accelerator(GA)-阿里云帮助中心

HTTPS listener certificate management

An HTTPS listener supports two categories of certificates:

Default server certificate

The SSL certificate that you select when creating an HTTPS listener becomes the default server certificate. You can replace the default server certificate but cannot delete it.
Additional certificate

Additional certificates let you map multiple domains to a single HTTPS listener. You can then use domain-based forwarding rules to route requests for different domains to different virtual endpoint groups.

Each HTTPS listener supports up to 25 additional certificates.

Limitations

A standard GA instance supports RSA and ECC certificates. ShangMi (SM) certificates are not supported.
For a standard GA instance with a subscription, if the default server certificate uses the ECC algorithm, all additional certificates must also use the ECC algorithm. Otherwise, the domains associated with the additional certificates may fail to be resolved.

For more information about supported encryption algorithms for SSL certificates, see SSL certificate selection guide.

Prerequisites

A standard GA instance is created.
For subscription-based GA instances, you must have purchased and associated a basic bandwidth plan.
You have added an acceleration region. For more information, see Add and manage acceleration regions.
If your website is deployed in the Chinese mainland or if you select an acceleration region in the Chinese mainland, you must complete an ICP filing to provide services. For more information, see What is an ICP filing?.
Make sure that you have purchased and applied for multiple SSL certificates. For more information, see Purchase an official certificate and Submit a certificate application.

Configuration workflow

Step 1: Associate a default server certificate

Create an HTTPS listener and select an SSL certificate. The certificate becomes the default server certificate, and the endpoint group you configure becomes the default endpoint group. For more information, see Add an HTTP or HTTPS listener.

Log on to the GA console.
On the Instances, find the target GA instance, and in the Actions column, click Configure Listener.
On the Listener tab, click Add Listener.

Note
Skip this step if this is the first listener you are adding, or if no listeners exist for the current GA instance.
On the Configure Listener & Protocol wizard page, configure the listener and protocol, and then click Next.

The following parameters are relevant:
- Select a server certificate: Select an SSL certificate that you have applied for. The certificate selected here serves as the default server certificate for the HTTPS listener.
- TLS Security Settings: Select a TLS security policy that meets your business requirements. For more information about TLS security policies, see TLS security policies.
On the Configure Endpoint Group wizard page, configure the endpoint group and endpoints, and then click Next.

The endpoint group configured here becomes the default endpoint group for the HTTPS listener.
On the Configuration Review wizard page, confirm the settings and click Submit.

Step 2: Add virtual endpoint groups

Add your origin servers as separate virtual endpoint groups. For more information, see Add a virtual endpoint group.

Step 3: Associate additional certificates

Log on to the GA console.
On the Instances, find the target GA instance, and in the Actions column, click Configure Listener.
On the Listener tab, find the target HTTPS listener and click its ID.
On the listener details page, click the Certificates.
On the Certificates, in the Additional Certificate section, click Associate Certificate.
In the Associate Certificate dialog box, configure the additional certificate based on the following information, and then click OK.
- Certificate: Select the certificate that you want to associate.
- Associated Domain Name: Select the domains from this certificate that you want to accelerate by using Global Accelerator. You can select multiple domains.
The default quota allows you to add up to three additional certificates. You can click + Add Certificate to associate multiple additional certificates at once. To associate more additional certificates, go to Quota Center and request an increase for the gaplus_quota_additional_certs_per_listener quota. For more information, see Manage GA quotas.

Step 4: Add forwarding rules

Add a domain-based forwarding rule for each virtual endpoint group. For more information, see Add and manage forwarding rules.

Step 5: Configure CNAME records

Configure a CNAME record for each domain you want to accelerate so that DNS resolves the domains to the CNAME of the GA instance. For more information, see Configure a CNAME record.

More operations

Actions	Description
Replace the default server certificate	On the Listener tab, find the target HTTPS listener and click its ID. On the listener details page, click the Certificates. On the Certificates, in the Default Server Certificate section, find the default server certificate and click Replace in the Actions column. In the Change Default Server Certificate dialog box, select the target certificate and click OK.
Replace an additional certificate	Replace an expired additional certificate with a new one while keeping the associated domains. On the Listener tab, find the target HTTPS listener and click its ID. On the listener details page, click the Certificates. On the Certificates, in the Additional Certificate section, find the target additional certificate and click Replace in the Actions column. In the Replace Additional Server Certificate dialog box, select the new certificate and click OK.
Disassociate additional certificates	Disassociating only removes the link between an additional certificate and the HTTPS listener. To delete the certificate itself, see Revoke and delete an SSL certificate. On the Listener tab, find the target HTTPS listener and click its ID. On the listener details page, click the Certificates. On the Certificates, in the Additional Certificate section, disassociate one or more additional certificates in one of the following ways: To disassociate a single additional certificate, find the target additional certificate and click Disassociate in the Actions column. To disassociate multiple additional certificates, select them and click Batch Disassociate below the certificate list. In the dialog box that appears, click OK.

Associate and manage certificates