Multi-cloud deployment: Deploy certificates to third-party cloud platforms

Step 1: Purchase deployment quotas

• If you have insufficient deployment quotas, purchase deployment quotas.

• Deployment quotas are not consumed in the following scenarios:

  • The certificate type is not Uploaded.

  • The certificate is shared between Alibaba Cloud accounts that belong to the same verified individual or enterprise.

  If a deployment fails, the consumed deployment quota is returned.

Step 2: Connect to a third-party cloud account

Before deploying an SSL certificate to a third-party cloud product, you must authorize the corresponding permission policies for a sub-user on the third-party cloud platform and then connect the sub-user's AccessKey pair to Alibaba Cloud.

1. Log in to the Certificate Management Service console.

2. In the navigation pane on the left, choose Comprehensive Management > Multi-cloud AK Management.

3. On the Multi-cloud AK Management page, click Add Authorization.

4. Click the target cloud service provider and configure the user account by following the on-screen instructions.

   The following example demonstrates how to authorize a Tencent Cloud sub-user (for reference only):

   1. Log on to the Tencent Cloud console, go to the User List, and click Create User.

   2. On the Create User page, click Quick Create.

   3. On the Quick Create User page, configure the user information.

      • Username: Enter a custom username.

      • Access Mode: Click the icon and select Programmatic Access.

      • User Permissions: Click the icon, and select QcloudSSLFullAccess (full read and write access for SSL certificates) and the read and write permissions for the corresponding cloud product.

        Note

        For example, to deploy an Alibaba Cloud certificate to Tencent Cloud CDN, you must also grant QcloudCDNFullAccess (full read and write access for Content Delivery Network).

      The following example shows a successfully created user:

   4. On the Submit AK wizard in the Digital Certificate Management Service console, enter the Tencent Cloud sub-user or main account credentials, and click OK.

Step 3: Deploy the SSL certificate to a third-party cloud product

1. In the navigation pane on the left, choose Deployment and Resource Management > Multi-cloud Deployment.

2. On the Multi-cloud Deployment page, click Create Task and complete the certificate deployment by performing the following steps.

   1. On the Configure Basic Information wizard page, configure the deployment task name, select an AccessKey pair, specify contacts and a deployment time, and then click Next.

      Parameter	Description
      Task Name	Customize the name of the deployment task.
      Select AK	Select the third-party cloud account that you connected in Step 2. If no AccessKey pair is available, click Add New AK and configure the AccessKey pair by referring to Supported third-party cloud products.
      Contact	Select contacts to receive deployment task notifications. You can add up to 10 contacts.
      Deployment Time	Deploy Now: Immediately deploy the certificate to the corresponding cloud product. Custom Time: Specify a time to run the deployment task. The system automatically starts the task at the specified time.

   2. On the Select Certificate wizard page, select the SSL certificate that corresponds to the cloud product resource (you can select one or more certificates), and then click Next.

      • Certificates issued by the Private Certificate Authority (PCA) service are synchronized to the Uploaded Certificates tab, where you can select them.

      • A single deployment task supports only one certificate type.

   3. On the Select Resource wizard page, the system automatically identifies and retrieves all resources from the corresponding cloud product. Select the target cloud product and resources (you can select one or more), and then click Preview and Submit.

   4. On the Task Preview page, confirm that the certificate instance and cloud product resource information are correct, and then click Submit.

      The preview page displays the number of certificates that match the cloud product and the deployment quotas to be consumed.

      • If the number of matching certificates is 0, the selected certificates do not match the cloud product resources, and the deployment will fail. Carefully verify your certificate selection.

      • The consumed deployment quota is based on the number of resources matched by the uploaded certificate. If a match is found but the deployment ultimately fails after the task starts, the consumed quota for that resource is returned.

Step 4: Verify whether the SSL certificate is installed

Next steps (Optional)

Certificate not working or HTTPS inaccessible

Common causes include:

• The domain name has not completed ICP filing. For more information, see How to view domain name resolution records and ICP filing information.

• The Bound Domains of the certificate does not include the domain name you are accessing. For more information, see How to determine whether the bound domain name matches all protected domain names.

• The certificate file is not correctly replaced. Make sure that the certificate file is the latest and valid version.

• The domain name is integrated with cloud services such as CDN, SLB, or WAF, but the certificate is not installed on the corresponding service. For more information, see Certificate deployment location when traffic passes through multiple cloud services.

• The domain name resolves to multiple servers, but the certificate is installed on only some of them. You must install the certificate on each server.

Cross-account certificate deployment

You cannot directly deploy Alibaba Cloud SSL certificates across different accounts.

• If multiple accounts belong to the same verified identity, you can use the certificate sharing feature to deploy certificates across accounts at no charge. For more information, see Upload, synchronize, and share SSL certificates.

• If the accounts belong to different verified identities, you must download the certificate from the source account and then manually upload and deploy it to the destination account.

Does deployment enable HTTPS automatically?

Deploying a certificate from the SSL Certificates Service console only pushes it to the target cloud service. You must still verify the deployment in that service's management console.