HTTPS listeners use SSL certificates to enable encrypted access and identity authentication. This topic describes the complete workflow for using certificates in CLB, including certificate selection and format preparation, certificate creation, association with an HTTPS listener, and subsequent replacement and renewal on expiration.
Certificate selection and preparation
Authentication modes
CLB supports one-way authentication and mutual authentication:
One-way authentication: CLB requires only a server certificate. The client verifies the identity of the server.
Mutual authentication: CLB requires both a server certificate and a CA certificate. The server and the client authenticate each other.
Most public-facing websites need only one-way authentication. Configure mutual authentication only when you need to verify the identity of the client, such as for internal enterprise systems or API caller authentication.
Certificate sources
CLB supports certificates from two sources:
Alibaba Cloud Certificate Management Service: Directly select a certificate that you have purchased in Alibaba Cloud Certificate Management Service. This method facilitates centralized management and provides expiration reminders and one-click renewal. It supports only server certificates and does not support client CA certificates.
Third-party certificate: Upload a certificate issued by another provider or a self-signed certificate. With this method, you must manually upload the public key and private key files of the certificate. It supports both server certificates and client CA certificates.
A client CA certificate can be added only by uploading its content and cannot be selected from Alibaba Cloud Certificate Management Service. If you need to build your own CA and issue client certificates, see Generate a CA certificate.
Certificate format requirements
CLB supports only certificates in PEM format. Before you create a certificate, make sure that your certificate, certificate chain, and private key meet the following format requirements. Certificates in other formats must first be converted to PEM format. For more information, see Convert the certificate format.
Supported certificate type: international standard certificates (RSA).
Supported public key algorithms: RSA 1024, RSA 2048, and RSA 4096.
PEM files that contain the
BEGIN DH PARAMETERSfield cannot be uploaded. The ECDHE cipher suites used by HTTPS listeners already support perfect forward secrecy, so the security enhancement parameter files required by DHE cipher suites are not needed.
The format requirements for a public key certificate vary by issuing authority. Refer to the requirements that correspond to your certificate source:
Certificate issued by a root CA
If the certificate is issued by a root CA, you receive a single certificate and no additional certificates are required. The configured site is then trusted by access devices such as browsers.
The certificate format must meet the following requirements:
It starts with
-----BEGIN CERTIFICATE-----, -----END CERTIFICATE-----and ends with the same.Each line contains 64 characters, and the last line can contain fewer than 64 characters.
The certificate content cannot contain spaces.
Certificate issued by an intermediate CA
If the certificate is issued by an intermediate CA, the certificate file that you receive contains multiple certificates. You must combine the server certificate and the intermediate certificate before you upload them.
The certificate chain format must meet the following requirements:
The server certificate comes first, followed by the intermediate certificate, with no blank lines between them.
The certificate content cannot contain spaces.
There cannot be blank lines between certificates, and each line must contain 64 bytes. For more information, see RFC1421.
The certificate meets the required format. In general, an intermediate CA provides corresponding instructions when it issues a certificate, and the certificate must meet the format requirements of the CA.
The following example shows a certificate chain issued by an intermediate CA:
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----RSA private key format requirements
When you upload a server certificate, you must also upload the private key of the certificate.
The RSA private key format must meet the following requirements:
It starts with
-----BEGIN RSA PRIVATE KEY-----, -----END RSA PRIVATE KEY-----and ends with the same. Upload this content along with the key.There cannot be blank lines between strings. Each line contains 64 characters, and the last line can contain fewer than 64 characters. For more information, see RFC1421.
If your private key is encrypted, for example, if the private key starts and ends with -----BEGIN PRIVATE KEY-----, -----END PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----, -----END ENCRYPTED PRIVATE KEY-----, or if the private key contains Proc-Type: 4,ENCRYPTED, you must first run the following command to convert it:
openssl rsa -in old_server_key.pem -out new_server_key.pemIn some later versions of OpenSSL,openssl rsaoutputs PKCS#8 by default, which causes the conversion to fail. Useopenssl rsa -in old_server_key.pem -out new_server_key.pem -traditionalto convert it.
Convert the certificate format
If your certificate is not in PEM format, use OpenSSL to convert it to PEM format before you upload it.
DER to PEM
The DER format is typically used on the Java platform. Certificate files usually have a .der, .cer, or .crt extension.
Run the following command to convert the certificate:
openssl x509 -inform der -in certificate.cer -out certificate.pemRun the following command to convert the private key:
openssl rsa -inform DER -outform PEM -in privatekey.der -out privatekey.pem
P7B to PEM
The P7B format is typically used in Windows Server and Tomcat.
Run the following command to convert the certificate:
openssl pkcs7 -print_certs -in incertificate.p7b -out outcertificate.cerPFX to PEM
The PFX format is typically used in Windows Server.
Run the following command to extract the certificate:
openssl pkcs12 -in certname.pfx -nokeys -out cert.pemRun the following command to extract the private key:
openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes
Certificate matching logic in multi-domain scenarios
An HTTPS listener can be configured with only one default certificate. To use different certificates for multiple domain names on the same HTTPS listener, use the additional domain feature.
When a client sends a request, CLB uses Server Name Indication (SNI) to identify the requested domain name: it first uses the certificate configured for the additional domain that matches the domain name; if no matching certificate is found, it uses the default certificate configured for the listener.
When a listener uses multiple wildcard certificates, only the wildcard certificate that is configured first automatically matches all subdomains under it. Wildcard certificates that are configured later do not match automatically. You must add an additional domain for each specific subdomain and specify the corresponding wildcard certificate.
For example, if you first configure a *.example.com certificate and then configure a *.test.com certificate, the matching behavior of the two differs:
Domain name accessed by the client | Automatically matches the certificate | Required operation |
| Yes. Automatically matches the | No additional configuration required. |
| No. Does not automatically match the | Add an additional domain for |
Note the following when you use additional domains:
Only guaranteed-performance CLB instances support SNI, which means only these instances support additional domains.
The additional domain that you add must be consistent with the domain name in the selected server certificate.
An additional domain takes effect only when it is used together with a forwarding rule, and the domain name configured in the forwarding rule must be consistent with the additional domain.
By default, an HTTPS listener supports up to 3 additional domains, which can be increased to a maximum of 10.
For the configuration method and complete description of additional domains, see CLB additional domain names.
Limits
Only HTTPS listeners support associating certificates. HTTP listeners transmit data in plaintext, and Layer 4 listeners such as TCP and UDP listeners do not support associating certificates. To enable encrypted transmission on these listeners, deploy the certificate on your backend servers.
Certificates cannot be used across regions or across accounts. To use a certificate in multiple regions, select all required regions when you create the certificate. To use a certificate in multiple accounts, first Download an SSL certificate in the account where the certificate was created, and then upload it in the target account.
Create a certificate
Console
Complete the preparations:
Use a certificate issued by Alibaba Cloud: Make sure that you have purchased or uploaded the required server certificate in the SSL Certificates Service console.
Use a third-party certificate: Prepare the public key and private key files of the server certificate in PEM format. For mutual authentication, also prepare the public key file of the CA certificate in PEM format.
Go to the CLB console. In the left-side navigation pane, choose CLB > Certificates, and then click Add Certificate.
In the Add Certificate panel, complete the configuration based on the certificate source, and then click Create.
Select Alibaba Cloud Certificates, select the SSL certificate that you need from the Certificates, and select the Region.
Select Third-party Certificates and complete the following configuration:
Certificate Type: Select the type of certificate to upload. The page displays the corresponding configuration items based on the selected type.
If you select Server Certificate, upload the public key certificate and private key, and select the Region.
If you select CA Certificate, upload the client CA public key certificate (used to verify the client identity in mutual authentication), and select the Region.
The uploaded certificate content is compatible with the NGINX format. You can click View Sample to refer to the correct format.
API
Call UploadServerCertificate to upload a server certificate. When you use a certificate issued by Alibaba Cloud, pass
AliCloudCertificateIdto specify the certificate. When you upload a third-party certificate, pass the certificate content and private key throughServerCertificateandPrivateKey.Call UploadCACertificate to upload a client CA certificate, and pass the certificate content through
CACertificate.
Associate a certificate with an HTTPS listener
After a certificate is created, it takes effect only after it is associated with an HTTPS listener. A certificate is selected when you add an HTTPS listener. The following sections list only the configuration items related to certificates. For the complete listener configuration process, see Add an HTTPS listener.
HTTPS listeners complete decryption on CLB and forward requests to backend servers over HTTP instead of HTTPS. Therefore, backend servers must provide services over HTTP, and you must make sure that configurations such as health checks and backend ports match the HTTP protocol (for example, the backend port is usually 80).
Console
In the Certificate Management Service configuration wizard, select the server certificate that you created.
Optional: Click Modify to the right of Advanced Settings, and configure mutual authentication and the TLS security policy as needed.
Turn on Mutual Authentication and select the CA certificate that you uploaded. If you use a self-built CA to issue client certificates, see Generate a CA certificate.
Select a TLS Security Policy. Only guaranteed-performance instances support selecting a TLS security policy. For the TLS protocol versions and cipher suites supported by each policy, see TLS security policies.
Follow the wizard to complete configurations such as backend servers and health checks, and then submit. After the listener is created, the certificate takes effect.
API
Call CreateLoadBalancerHTTPSListener to associate a certificate when you create an HTTPS listener. Specify the server certificate through
ServerCertificateId. For mutual authentication, specify the CA certificate throughCACertificateId.Call SetLoadBalancerHTTPSListenerAttribute to modify the certificate associated with an existing HTTPS listener.
Replace a certificate
When a certificate is about to expire, you need to change the issuing authority, or the certificate is misconfigured, you must replace the certificate. CLB provides two replacement methods. Select one based on the scope of impact. Regardless of the method that you use, we recommend that you Verify that the certificate takes effect after the replacement is complete.
Comparison item | Method 1: Replace the listener certificate | Method 2: Replace the certificate through certificate management |
Scope of impact | Only the default certificate of the current HTTPS listener. | All listeners and additional domains associated with the certificate. |
Scenario | You need to replace the certificate of only one listener, or you also need to adjust mutual authentication or the TLS security policy. | The same certificate is used by multiple listeners or additional domains, and you need to replace all of them at once. |
Prerequisite | None. | The certificate is associated with at least one listener or additional domain. |
When you replace a certificate, CLB updates the certificate configuration of the listener. During this process, a brief HTTPS connection interruption may occur (about a few seconds, shown as an SSL connection error), after which the connection automatically recovers. We recommend that you perform this operation during off-peak hours. If an exception occurs after the replacement, you can roll back by changing the listener certificate back to the original certificate.
Method 1: Replace the listener certificate
Console
Go to the CLB console and click the target instance ID. On the Listener tab, find the target HTTPS listener. In the Operations column, click Manage Certificate.
In the Manage Certificate panel, select a new server certificate from the Server Certificate (Default Certificate) drop-down list. To also adjust mutual authentication or the TLS security policy, modify them in Advanced Settings, and then click OK.
This method replaces only the default certificate of the listener and does not replace the certificates on additional domains. If the listener is configured with additional domains, update the certificates of the additional domains separately, or use the following method to replace all objects associated with the certificate at once.
API
Call UploadServerCertificate to upload the new certificate and obtain the new certificate ID.
Call SetLoadBalancerHTTPSListenerAttribute and pass the new
ServerCertificateIdto update the certificate of the HTTPS listener.If the listener is configured with additional domains, call SetDomainExtensionAttribute for each additional domain to update its certificate separately.
Updating only the listener certificate does not update the certificates on additional domains at the same time. If you miss an additional domain, the old certificate is still used when the corresponding domain name is accessed.
Method 2: Replace the certificate through certificate management
After you replace a certificate through certificate management, the certificates on all listeners and additional domains associated with the certificate are also replaced automatically.
Only a certificate that is associated with at least one listener or additional domain can be replaced.
Go to the CLB console. In the left-side navigation pane, choose CLB > Certificates.
On the Certificates page, find the target certificate to replace. In the Operations column, click Change Certificates. On the Replace Server Certificate page, complete the configuration, and then click Change Certificates.
Select Create and Replace Certificate.
Select Alibaba Cloud Certificates and select the new certificate from the Certificates.
Select Third-party Certificates and paste the public key and private key content of the new certificate.
Select Replace with Existing Certificate and select the server certificate to use for replacement from the list of existing certificates.
Click Go to Certificate List. On the Certificates page, you can confirm that the associated listeners and additional domains have been updated with the new certificate.
Verify that the certificate takes effect
Access the site through a browser and check the validity period in the certificate details. We recommend that you use incognito mode to avoid the impact of caching on your judgment.
If additional domains are configured, verify each domain name separately to confirm that each domain name returns the expected certificate.
Certificate expiration and renewal
After a certificate expires, clients that access your site are prompted that the certificate has expired or is insecure. Therefore, you must complete the replacement before the certificate expires.
When you use a certificate issued by Alibaba Cloud Certificate Management Service, you can benefit from expiration reminders and one-click renewal. We recommend that you keep track of expiration notifications in this service.
Before the certificate expires, first obtain a new certificate (renew or reissue the certificate in Alibaba Cloud Certificate Management Service, or apply for a new certificate from a third-party issuing authority), and then replace and verify the certificate in CLB based on the preceding sections.
After you renew or reissue a certificate in Certificate Management Service, the certificate used by the CLB listener is not updated automatically. You must still perform the certificate replacement operation in CLB.
More information
Quotas
Quota name | Description | Default value | Adjustable |
slb_quota_certs_num | The number of server certificates that can be uploaded in each region. | 100 | |
slb_quota_ca_certs_num | The number of client CA certificates that can be uploaded in each region. | 100 |