Download an SSL certificate

Prerequisites

You have issued a certificate through the Certificate Management Service console. For details, see Purchase an official certificate.

How to apply for a free certificate: You can submit a free certificate application in the Certificate Management Service console. Note that free certificates have an annual quota limit. If the quota for the current year has been exhausted, you need to purchase an official certificate.

Purchase channel and download location mapping: Certificates purchased through SSL Certificate Management V2.0 must be viewed and downloaded from the SSL Certificate Management V2.0 page. Certificates purchased through non-V2.0 channels should be viewed on the legacy (V1.0) page. If you have records in the order refund management but no certificates appear in the certificate list, verify your purchase channel and log in to the corresponding console version.

Notes

• For data security, third-party certificates uploaded to Certificate Management Service for centralized management cannot be downloaded for use on self-built server deployments. If you need to centrally manage and automatically deploy to cloud products through the console, this may involve related service fees or require specific hosting features. For details, see the certificate hosting documentation.

• You can download an SSL certificate only when its status is Issued, Pending Expiration, or Expired. Certificates in other states cannot be downloaded.

• A certificate must be deployed to a business server to be actually used. If you only need to obtain the certificate file, you must still complete the application and issuance process first, then download the certificate file for manual deployment.

Procedure

1. Log in to the Certificate Management Service console.

2. For certificates purchased through V2.0, choose Certificate Management > SSL Certificate Management V2.0 in the left-side navigation pane. For certificates purchased through V1.0, choose Certificate Management > SSL Certificate Management (V1.0 no longer available for new purchases).

3. On the Commercial Certificates or Individual Test Certificate (Formerly Free Certificate) tab, select the certificate to download and click Download below the certificate list.

   Certificate delivery instructions: If you are an intermediary purchaser (not the final deployer), deliver the downloaded certificate package in the format matching the target server (including public key, private key, and password file) in its entirety to the person responsible for deployment, and remind them to properly safeguard the private key file.

4. In the dialog box that appears, select the certificate format that matches your server type, download the certificate package, and decompress it.

   If the certificate format that matches your server type is not listed, download the PEM format and convert it using a certificate conversion tool. For details, see Convert certificate formats.

   Note

   • For information about how to check the server type, see Query the server type.

   • The downloaded certificate file typically includes an intermediate certificate. If you encounter an untrusted intermediate certificate issue when installing the SSL certificate, contact your account manager.

   • If you used a certificate signing request (CSR) file manually generated by using tools such as OpenSSL or Keytool during the certificate application process, the private key is managed locally. The downloaded certificate package does not include the private key file.

   • The downloaded certificate package already includes certificate files for both the primary domain and its subdomains. The file names are typically based on the certificate ID or the bound domain name. You can directly use the PEM or CRT file in the package as the primary domain certificate without searching for a specific file name.

   • If you are unsure which file to select, the PEM format (which includes the certificate chain) together with the KEY file is generally the recommended choice. Upload them to your web server to complete the deployment.

   • If you are unsure of your server type, download all available certificate format packages. Once you confirm the server environment, select the corresponding certificate file for deployment.

   Server types and certificate formats

   When you download a certificate, the dialog box provides the following certificate formats:

   Certificate type	Server type	Certificate format	Files in the package
   SSL certificate	NGINX	PEM A Base64-encoded universal certificate format that can be viewed as plain text. Applies to most servers or applications such as NGINX.	domain name.pem: the certificate file. domain name.key: the private key file of the certificate.
   	Tomcat	PFX (also known as PKCS#12) A binary format that contains both the public key and private key. Applies to servers such as Tomcat, IIS, and Exchange.	domain name.pfx: the certificate file in PFX format. pfx-password.txt: the password that protects the certificate. Note When you submit the certificate request, if you did not set CSR Generation Method to System Generated, the downloaded certificate package does not include the TXT password file.
   	Apache	CRT A binary format that contains the certificate and related metadata (issuer information, validity period, subject, and more), but not the private key. Applies to Apache servers.	domain name_public.crt: the certificate file. domain name_chain.crt: the certificate chain file. domain name.key: the private key file of the certificate.
   	IIS	PFX (also known as PKCS#12) A binary format that contains both the public key and private key. Applies to servers such as Tomcat, IIS, and Exchange.	domain name.pfx: the certificate file. pfx-password.txt: the password that protects the certificate.
   	JKS	JKS A keystore format exclusive to the Java platform. Applies to Java-based web servers or applications such as Tomcat and Jetty.	The decompressed package contains the following files: domain name.jks: the certificate file. jks-password.txt: the password that protects the certificate.
   	Other	PEM A general-purpose certificate format based on Base64 encoding that can be viewed as plain text. If the format you need is not available in the console, select this format and convert it manually after download.	Certificate files in PEM format: domain name.pem: the certificate file in PEM format. domain name.key: the private key file of the certificate.
   	Download Root Certificate	A root certificate is typically in CRT or CER format. It applies to non-PC browser scenarios such as app services and IoT terminals that do not have pre-installed root certificates. You need to download and install the root certificate for the corresponding SSL certificate brand. For more information, see View document.	N/A
   SM2 certificate	N/A	PEM	PEM SM2 certificates use the PEM format regardless of the server type. After decompression, the package contains the following files: Signing certificate and private key: domain name_sm2_sign.pem and domain name_sm2_sign.key. Encryption certificate and private key: domain name_sm2_enc.pem and domain name_sm2_enc.key.

   Obtaining .cer format: If your business system (such as SAP Web Dispatcher) requires the .cer format, you can download the CRT format certificate corresponding to Apache and directly change the file extension from .crt to .cer. The console does not provide .cer format files. Alternatively, you can download the PEM format certificate and change the extension from .pem to .cer.

   Nginx certificate file notes: The .pem and .key files corresponding to Nginx are Base64-encoded text files. If you cannot open them directly on your local machine, we recommend using a text editor such as Notepad to view the contents.

   Free certificate format notes: Image format is not available for free SSL certificate downloads. The image format you may see typically belongs to domain name certificates (such as brand logos), not SSL certificate files used for server deployment. Please download standard formats such as PEM or PFX for deployment.

   Multi-domain certificate explanation: It is normal to receive only one certificate file when downloading a multi-domain SSL certificate. A multi-domain certificate is a single certificate file that covers multiple domains. This certificate can be universally deployed to all bound domains; the system does not generate separate certificate files for each domain.

   Downloaded file name does not match expectations: If the downloaded file name does not match your expectations, check that you selected the correct server type. Different server types use different file extensions and content structures.

   Only image files when downloading: If the downloaded SSL certificate file appears as an image, verify whether there was an operation error or browser rendering issue. We recommend logging in to the Certificate Management Service console and following the steps in this document to re-download the certificate package and extract it to obtain the correct format.

   Cannot find certificate in console or cannot download private key: Verify whether your account has an SSL public certificate record for the domain. If no record exists, check whether you locally saved the private key from when the CSR was generated. If the private key is lost, you will need to regenerate the CSR and reissue the certificate.

What to do next

After you download the SSL certificate to your computer, manually configure it on your web application server. For more information, see Manually Deploy a Certificate.

• Non-Alibaba Cloud platform deployment: If deploying to a proxy device, refer to the corresponding platform documentation for configuration. If deploying to a server, configure the deployment in the server's configuration file based on the web server type (such as Nginx or Apache).

• Third-party cloud platform deployment: When deploying to a third-party cloud platform (such as Cloudflare), you need to first download the certificate and upload it to the target server, then fill in the corresponding certificate and private key absolute paths in the configuration file based on the specific web server type (such as Nginx or Apache).

• Domain on Alibaba Cloud but server not on Alibaba Cloud: If your domain is registered on Alibaba Cloud but your server is hosted elsewhere, you cannot use the one-click deployment feature. You need to apply for and download the certificate file suitable for your current web server type (such as Nginx or Apache) from the Certificate Management Service console, then manually configure the SSL certificate on your own server and enable port 443 for listening. Ensure that the Alibaba Cloud domain name resolution points to that server IP.

• Yunmeng Website Builder (Wanxiaozhi) deployment:

  1. Download the SSL certificate from the Certificate Management Service console, selecting the Nginx format.

  2. After extraction, open the .pem and .key files with a text editor and copy their contents.

  3. Log in to the Yunmeng Website Builder (Wanxiaozhi) console, find the Configure HTTPS Custom Certificate option for the corresponding domain, and paste the .pem file content (certificate) and .key file content (private key) for upload.

  4. If access still shows as insecure after configuration, clear the browser cache or use incognito mode or a different browser to test.

• Baota Panel deployment: Log in to the Baota Panel, go to Website Settings > SSL, select Other Certificate, and paste the downloaded Nginx format certificate contents (.pem and .key) into the key and certificate fields respectively. Save and enforce HTTPS.

• Cloud Enterprise Official Website deployment: After downloading and extracting the Nginx format certificate package, log in to the Cloud Enterprise Official Website backend, go to the HTTPS configuration page, and paste the contents of the extracted certificate file (.pem) and private key file (.key) into the corresponding input fields and save.

• Re-deploying certificates on a new server: If you need to re-deploy the certificate on a new server or different architecture, choose the appropriate deployment scheme based on your business scenario. See SSL Certificate Deployment Scheme Selection for applicable scenarios and operation guides for automatic deployment, manual deployment, and load balancing deployment.

• Deployment for different server types: After issuance, you can refer to the following documents for deployment based on your web server type:

  • Nginx, Apache, and other servers: See Install SSL Certificate to Server.

  Core manual deployment process:

  1. Upload the downloaded certificate file to the specified directory on the server.

  2. Modify the configuration file based on the web server type (such as Nginx or Apache) to specify the certificate and private key paths.

  3. Restart or reload the service to apply the configuration.

• Alibaba Cloud Enterprise Mail integration: After purchasing an SSL certificate, you can upload it to the Alibaba Cloud Enterprise Mail backend for use, with support for enforcing HTTPS. For uploading SSL certificates, refer to Enterprise Mail SSL Certificate Configuration.

• Certificate expiration handling: If the SSL certificate has expired, go to the certificate console to re-apply for a certificate. When applying, fill in the primary domain name, and the corresponding www subdomain will be automatically included after issuance. After submitting the application, add a DNS record for domain verification. Once verified, you can download the new certificate and deploy it to your business. If the free certificate annual quota has been exhausted, you need to purchase an official certificate.

FAQ

Q: What is the difference between the SSL certificates in this document and domain name certificates?

A: This document covers only the download of SSL digital certificates. If you need to download a domain name certificate in PDF format for filing with the Ministry of Public Security, go to the domain name console or the filing system.

Q: Do I need to download each SSL certificate separately after issuance?

A: Yes, you need to download each issued certificate separately based on the format required for your deployment environment. For example, deploying to an Nginx server requires downloading the Nginx format certificate. If deploying to products such as Cloud Quick Website Builder, you need to upload or configure directly in the corresponding product console without manually downloading a specific format.

Q: What should I do if the original deployer is no longer available?

A: You can refer to the Alibaba Cloud help documentation for manual deployment tutorials to configure it yourself. If you need assistance, you can purchase the expert deployment service for expert support.

Q: What should I do if downloading a free SSL certificate fails or the file cannot be opened?

A: We recommend using a desktop browser for downloading. If the downloaded file cannot be opened directly, you can use a text editor such as Notepad to view the certificate contents and confirm the certificate file has been correctly obtained.

Q: How do I deploy and install an SSL certificate after downloading?

A: After downloading the SSL certificate to your local machine, you need to manually configure and deploy it based on your web server type. See Manually Deploy a Certificate, or refer to Install SSL Certificate to Server for deployment guides for different server types.