Configure certificates for an ALB instance-Server Load Balancer(SLB)-阿里云帮助中心

Certificate selection and preparation

Before you configure a certificate, determine the authentication mode and the certificate type, and prepare the required certificates in Certificate Management Service.

Authentication modes

ALB supports one-way authentication and mutual authentication (mTLS). Select a mode based on your business requirements.

One-way authentication: The client verifies the identity of the server, and the server does not verify the identity of the client. When you configure an HTTPS listener or a QUIC listener, you must bind a server certificate to the listener.
Mutual authentication (mTLS): The client verifies the identity of the server, and the server also verifies the identity of the client. Requests and responses are processed only after both parties pass authentication, which helps secure data transmission. After you enable mutual authentication, you must bind a CA certificate to authenticate clients in addition to the server certificate.

Basic Edition and Extensible Edition instances do not support mutual authentication. HTTP listeners support neither one-way authentication nor mutual authentication. QUIC listeners do not support mutual authentication.

Certificate types

ALB supports international standard certificates (RSA and ECC) and SM certificates (SM2).

International standard certificates: Support the RSA and ECC algorithms and apply to common HTTPS encryption scenarios.
SM certificates: Support the SM algorithm suite, including SM2 for signatures and key exchange, SM3 for digests, and SM4 for data encryption. SM certificates apply to customers in the financial and government sectors and to industries that must meet Multi-Level Protection Scheme (MLPS) Level 3 requirements. To use an SM certificate, you must also use a custom TLS policy that contains the SM cipher suite (ECC-SM2-WITH-SM4-SM3). For a configuration example, see SM HTTPS Secure Communication.

The following limits apply to SM certificates:

Only Standard Edition and WAF-enabled Edition ALB instances support SM certificates. Basic Edition and Extensible Edition instances do not support SM certificates.
Only upgraded ALB instances support SM certificates. ALB instances that are not upgraded do not support SM certificates. You can use ALB instance cloning to manually migrate workloads from an existing ALB instance to an upgraded ALB instance.
The SM certificate feature is not enabled by default. You can apply for the privilege quota in the Quota Center console.
SM certificates do not support mutual authentication. CA certificates cannot be SM2 certificates.

The following table describes the certificate types and authentication modes that different types of listeners support.

Listener type	Certificate type	Authentication mode
Listener type	Certificate type	One-way authentication	Mutual authentication
HTTPS	A single RSA, ECC, or SM2 certificate	Supported	Supported (RSA and ECC) Not supported (SM2)
	Dual certificates: RSA and ECC	Supported	Supported
	Dual certificates: RSA and SM2	Supported	Not supported
	Dual certificates: ECC and SM2	Supported	Not supported
	Mixed certificates: RSA, ECC, and SM2	Supported	Not supported
QUIC	A single RSA or ECC certificate	Supported	Not supported
QUIC	Dual certificates: RSA and ECC	Supported	Not supported
HTTP	Certificates are not supported.

Certificate matching logic

If multiple certificates are bound to a listener, ALB uses an intelligent certificate selection algorithm that supports Server Name Indication (SNI). If the hostname that the client provides matches only one certificate in the certificate list, ALB selects that certificate. If the hostname matches multiple certificates, ALB selects the optimal certificate based on the following priorities:

Domain name match: An exact match takes precedence over a wildcard match.
Public key algorithm: ECDSA (ECC) takes precedence over RSA.
Hash algorithm: SHA algorithms take precedence over MD5.
Key length: The certificate with the longest key is preferred.
Validity period: The certificate with the longest remaining validity period is preferred.

ALB identifies whether the SM protocol (TLCP) is used based on the protocol version that the client sends during the TLS handshake. If the client uses TLCP, ALB prefers SM certificates. If the client uses standard TLS, ALB prefers international standard certificates (RSA and ECC).

Prepare certificates

ALB does not store certificate files. Certificates are issued, uploaded, renewed, and revoked in Certificate Management Service, and ALB only references issued certificates and binds them to listeners. Buttons such as Create SSL Certificate and Purchase Certificate in the ALB console also redirect you to Certificate Management Service. Prepare the certificates that your business requires in Certificate Management Service first.

Requirement	Operation in Certificate Management Service	Description
Use a server certificate issued through Alibaba Cloud	Purchase and apply for a certificate	A certificate can be selected in ALB only after its status becomes Issued. The certificate proves the identity of the server in both one-way authentication and mutual authentication.
Use a server certificate issued by a third party	Upload a certificate	You must upload both the public key file and the private key file of the certificate.
Use a CA certificate issued through Alibaba Cloud for mutual authentication	Purchase and enable a subordinate CA certificate	Make sure that the number of remaining certificates of the private subordinate CA is not 0. CA certificates are used to authenticate client certificates.
Use a self-signed CA certificate for mutual authentication	Upload a CA certificate by using a certificate repository	You can upload a self-signed root CA certificate or a self-signed subordinate root CA certificate. Before you upload a certificate, create a repository whose data source is Uploaded CA Certificates.

Prerequisites

An ALB instance is created. To use mutual authentication or SM certificates, the edition of the instance must be Standard Edition or WAF-enabled Edition.
An available backend server group is created.
The required server certificate, and the CA certificate if mutual authentication is used, are prepared in Certificate Management Service as described in the preceding table, and the certificate status is Issued.

Bind a certificate when you create a listener

The following steps describe only the settings that are closely related to certificates. For the complete listener creation procedure and other parameters, see Create and manage listeners.

Console

Go to the Instances page in the ALB console. Find the instance that you want to manage and click Create Listener in the Actions column.
In the Configure Listener step, set Listener Protocol to HTTPS or QUIC, specify the listener port, and then click Next.
On the SSL Certificate page of the wizard, select a server certificate.
If no server certificate is available, click Create SSL Certificate in the drop-down list to go to the Certificate Management Service console, where you can purchase or upload a server certificate.
Optional: Only HTTPS listeners support mutual authentication. To enable mutual authentication, turn on Enable Mutual Authentication, select a CA certificate source, and then select one or more CA certificates.
- Set CA Certificate Source to Alibaba Cloud and select one or more CA certificates from the list. If no CA certificate is available, click Purchase CA Certificate to create a CA certificate.
- Set CA Certificate Source to Third-party and select one or more CA certificates from the list. If no CA certificate is available, click Upload Self-signed CA Certificate to upload a self-signed CA certificate by using a certificate repository.
For an end-to-end example of mutual authentication, see HTTPS Mutual Authentication.
Select a TLS Security Policy, and then click Next.
If no tls security policy is available, click Create TLS Security Policy in the drop-down list.
A tls security policy contains the TLS protocol versions and cipher suites that an https listener can use.
Follow the wizard to select a server group, confirm the configurations, and then click Submit.

API

Call CreateListener to create an HTTPS or QUIC listener, and use the Certificates parameter to specify the server certificate.
When you create an HTTPS listener, you can also use the CaEnabled and CaCertificates parameters to enable mutual authentication and specify CA certificates.

Manage server certificates

The server certificates that are bound to a listener are classified into the default certificate and additional certificates. The default certificate must be specified when you create an HTTPS or QUIC listener. Additional certificates allow one listener to serve multiple domain names over HTTPS.

When you add or switch certificates, the listener keeps running and you do not need to stop it. The change takes effect immediately after you submit the configuration. After the new certificate takes effect, you do not need to delete the old certificate immediately. Multiple valid certificates can coexist on the same listener, and ALB selects the optimal certificate based on the certificate matching logic. ALB does not use expired or invalid certificates.

Console

Go to the Instances page in the ALB console and click the ID of the instance that you want to manage. On the Listener tab, find the HTTPS or QUIC listener that you want to manage and click Manage Certificates in the Actions column.

On the Server Certificates tab of the Certificates page, perform the following operations as required.

Operation	Description
Replace the default server certificate	Find the default server certificate of the listener and click Replace in the Actions column. In the dialog box that appears, select a server certificate and click OK. If no server certificate is available, click Create SSL Certificate in the drop-down list to go to the Certificate Management Service console, where you can purchase or upload a server certificate.
Add an additional certificate	Click Add EV Certificate. In the Add EV Certificate dialog box, select a server certificate and then click OK.
Delete an additional certificate	Find the additional certificate that you want to delete and click Delete in the Actions column. In the message that appears, click Delete. Before you delete a certificate, make sure that the domain name of the certificate is no longer served by this listener. Otherwise, requests to that domain name fall back to the default certificate because no certificate matches, and domain name verification fails on the client.

API

Call UpdateListenerAttribute and use the Certificates parameter to replace the default server certificate of a listener.
Call AssociateAdditionalCertificatesWithListener to add additional certificates.
Call DissociateAdditionalCertificatesFromListener to remove additional certificates.
Call ListListenerCertificates to query the server certificates and CA certificates that are bound to a listener.

Manage CA certificates and mutual authentication

After mutual authentication is enabled, ALB uses CA certificates to verify client certificates. You can bind multiple CA certificates to the same listener to trust client certificates that are issued by multiple certificate authorities.

Mutual authentication requires that both of the following conditions are met: the edition of the instance is Standard Edition or WAF-enabled Edition (Basic Edition and Extensible Edition are not supported), and the listener protocol is HTTPS (QUIC listeners are not supported).

SM certificates (SM2) do not support mutual authentication, and CA certificates cannot be SM2 certificates.

Console

Go to the Instances page in the ALB console and click the ID of the instance that you want to manage. On the Listener tab, find the HTTPS listener that you want to manage and click Manage Certificates in the Actions column.

On the Certificates page, click the CA Certificate tab and perform the following operations as required.

Operation	Description
Enable mutual authentication	Turn on Mutual Authentication. The Enable Mutual Authentication dialog box appears when you enable mutual authentication for the first time. Complete the configuration based on the CA certificate source. Set CA Certificate Source to Alibaba Cloud, select one or more CA certificates from the list, and then click OK. If no CA certificate is available, click Purchase CA Certificate in the upper-right corner of the dialog box to create a CA certificate. Set CA Certificate Source to Third-party, select one or more CA certificates from the list, and then click OK. If no CA certificate is available, click Upload Self-signed CA Certificate in the upper-right corner of the dialog box, create a repository whose data source is Uploaded CA Certificates on the Certificate Application Repository page, and then upload a self-signed root CA certificate or a self-signed subordinate root CA certificate. If mutual authentication was enabled for the listener before, the CA certificates remain in the CA Certificate list and are used directly when you enable mutual authentication again.
Add a CA certificate	Click Add CA Certificates. In the dialog box that appears, select the CA certificate source and the corresponding CA certificate, and then click OK.
Replace a CA certificate	Find the CA certificate that you want to replace and click Replace in the Actions column. In the Change Default CA Certificate dialog box, select the CA certificate source and the corresponding CA certificate. You can select only one CA certificate.
Delete a CA certificate	At least one CA certificate must be retained when mutual authentication is enabled. Find the CA certificate that you want to delete and click Delete in the Actions column. In the message that appears, click OK.
Disable mutual authentication	Turn off Mutual Authentication. After mutual authentication is disabled, the listener supports only one-way authentication and no longer verifies client certificates.

API

Call UpdateListenerAttribute. Use the CaEnabled parameter to enable or disable mutual authentication, and use the CaCertificates parameter to specify or replace CA certificates.

Certificate expiration and renewal

All SSL certificates have a validity period. For the exact validity period, refer to the certificate information in Certificate Management Service. After a certificate expires, clients no longer trust it, and your service is reported as insecure or becomes inaccessible. Replace the certificate manually before it expires, or enable certificate hosting to let Certificate Management Service handle the replacement automatically.

If multiple valid certificates are bound to a listener, ALB selects the optimal certificate based on the certificate matching logic and does not use expired certificates. If only one certificate is bound to the listener and that certificate has expired, clients report that the certificate is untrusted.

Manual replacement

Prepare the new certificate in Certificate Management Service. For a certificate that you purchased on Alibaba Cloud, complete the renewal and reissue. For a certificate that you obtained outside Alibaba Cloud, upload it to Certificate Management Service.
After the new certificate is ready, replace the default server certificate of the listener as described in Manage server certificates, or add the new certificate as an additional certificate. If mutual authentication is used, replace expired CA certificates as described in Manage CA certificates and mutual authentication.
Verify that the new certificate has taken effect:
- After you replace a server certificate, access the site in a browser and check the validity period in the certificate details. We recommend that you use incognito mode to prevent the browser cache from affecting the result.
- After you replace a CA certificate, send a request by using a client certificate that is issued by the new CA to confirm that mutual authentication succeeds.

Automatic replacement

Certificate Management Service provides certificate hosting, which automatically reissues a certificate before it expires and deploys the new certificate to ALB.

FAQ

The following symptoms may be affected by the browser cache. The browser may also stop displaying warnings because you previously chose to ignore a certificate warning. We recommend that you reproduce the symptoms in incognito mode to prevent a false diagnosis.

The browser still reports an insecure connection after a redirect from HTTP to HTTPS

Symptom: An SSL certificate is configured and an HTTPS listener is enabled, but the browser reports an insecure connection when you access the site over HTTP, or the address bar shows a URL similar to https://domain:80/ after the redirect.

Cause: The forwarding rule of the HTTP listener uses the ${port} variable as the redirect port. This variable retains the port of the original HTTP request, which is usually 80. As a result, the browser is redirected to https://domain:80/ instead of port 443, which is the standard HTTPS port, and cannot establish an SSL connection.

Solution: Change the redirect port in the forwarding rule of the HTTP listener from ${port} to the fixed value 443, which is the standard HTTPS port. After the change, the Location response header no longer contains the :80 port, and the browser can establish an HTTPS connection.

HTTPS access reports that the certificate domain name does not match

Symptom: When you access an HTTPS site in a browser, the browser reports that the certificate domain name does not match the site or that the certificate is untrusted.

Checklist: The domain name of the SSL certificate that is bound to the HTTPS listener must exactly match the domain name that clients access. Confirm the coverage of the certificate based on its type:

Single-domain certificate: Protects only the specified domain name, such as www.example.com, and does not protect other subdomains, such as api.example.com.
Wildcard certificate: Protects subdomains at the same level. For example, *.example.com protects www.example.com and api.example.com, but does not protect multi-level subdomains such as sub.www.example.com.

To serve multiple domain names on the same listener, add additional certificates to the listener and configure domain name-based forwarding rules. For more information, see Configure multi-domain HTTPS.

Quotas

General quotas

The following table describes the general quotas that are related to certificates. If the default value does not meet your business requirements, apply for a higher quota in the Quota Center console.

Quota name	Description	Default value	Maximum value
`alb_quota_loadbalancer_certificates_num_basic_edition`	Number of additional certificates that can be added to a Basic Edition instance, excluding the default certificate	10	150
`alb_quota_loadbalancer_certificates_num_standard_edition`	Number of additional certificates that can be added to a Standard Edition instance, excluding the default certificate	25	300
`alb_quota_loadbalancer_certificates_num_standardwithwaf_edition`	Number of additional certificates that can be added to a WAF-enabled Edition instance, excluding the default certificate	25	300
`alb_quota_loadbalancer_certificates_num_extensible_edition`	Number of additional certificates that can be added to an Extensible Edition instance, excluding the default certificate	25	Cannot be increased

Privilege quotas

The SM certificate feature is not enabled by default and is controlled by a privilege quota. The quota ID is slb_user_visible_gray_label/support_sm_certificate, which indicates that ALB supports SM certificates. Apply for the quota in the Quota Center console before you use SM certificates.