Overview of SSL certificate deployment methods
An SSL certificate does not take effect on its own after it is issued. You must deploy it where your service is exposed to visitors. Only then does a browser mark your website as secure. This topic describes where a certificate must be deployed and which deployment methods are available for each location.
Before you begin
Before you start, make sure that you have an SSL certificate issued by a trusted certificate authority (CA). To buy a certificate and apply for issuance, see Purchase a commercial certificate and Submit a CA application.
Also check whether your certificate is a standard SSL certificate (RSA/ECC) or a China Cryptography Standard SSL certificate (SM2). The available deployment methods differ.
Confirm where the certificate must be deployed
When a visitor accesses your website, the request may pass through services such as Content Delivery Network (CDN), Web Application Firewall (WAF), and load balancers before it reaches your server. For a request to use HTTPS at a specific hop, you must deploy a certificate at that hop. A hop without a certificate still uses HTTP, and the data in transit is not protected. As a result, you may need to deploy the certificate in more than one location. Common locations include web servers (such as Nginx, Apache, and IIS), Application Load Balancer (ALB), CDN, WAF, and Cloud-native API Gateway.
The following two situations are common:
Visitors access the web server directly
If requests do not pass through services such as CDN or WAF and reach your server directly, you only need to deploy the certificate on the web service of that server.
Requests pass through services such as CDN and WAF
If requests pass through services such as CDN and WAF, you must deploy a certificate at the entry point of each hop before that hop can use HTTPS. Take the path "visitor → CDN → WAF → load balancer → your server" as an example. If you deploy a certificate only on CDN, only the hop from the visitor to CDN uses HTTPS. The hops from CDN to your server still use HTTP. To use HTTPS along the entire path from the visitor to your server, deploy one certificate at each of the four locations.
Identify your deployment scenario
After you confirm where the certificate must be deployed, use the following table to identify the scenario for each location. Then go to the matching section to choose a deployment method.
Scenario | Reference |
The domain name resolves to a managed Alibaba Cloud service, or its CNAME record points to one, and that service provides HTTPS access. Examples include CDN, Dynamic Route for CDN (DCDN), WAF, Anti-DDoS Pro and Anti-DDoS Premium, load balancers (ALB, NLB, and CLB), Object Storage Service (OSS), Cloud Web Hosting, Cloud-native API Gateway, and Container Service for Kubernetes (ACK). | Scenario 1: Deploy the certificate to an Alibaba Cloud service |
The domain name resolves directly to the public IP address of a server, and HTTPS is provided by a web service that you installed on that server, such as Nginx, Apache, Tomcat, or IIS. This scenario applies to Alibaba Cloud ECS instances, Simple Application Server instances, cloud hosts on other platforms, and servers in your own IDC. | Scenario 2: Deploy the certificate to a self-managed web server |
The domain name resolves to a service on a third-party cloud platform such as Tencent Cloud, AWS, or Huawei Cloud, or its CNAME record points to one. The service can be CDN, WAF, or a load balancer, and it provides HTTPS access. | Scenario 3: Deploy the certificate to a service on a third-party cloud platform |
A mixed scenario. For example, the domain name resolves to CDN, CDN forwards requests to your self-managed Nginx server, and you want HTTPS along the entire path from the visitor to the server. | Perform a separate deployment for each scenario involved, and deploy one certificate at each location. |
If you need assistance with certificate deployment, . You can also contact a product technical expert for assistance. For more information, see One-on-one Expert Service.
Scenario 1: Deploy the certificate to an Alibaba Cloud service
If the certificate must be deployed to a managed Alibaba Cloud service such as CDN, WAF, or a load balancer, you have two options: push the certificate with one click in the Certificate Management Service console, or log on to the console of the target service and upload the certificate. We recommend the first option, because it saves you from downloading and uploading certificate files.
Method 1: Deploy with one click in the Certificate Management Service console (recommended)
In the Certificate Management Service console, use the cloud product deployment feature to push the certificate to the cloud products listed in the following table with one click. You do not need to download or upload certificate files manually. For more information, see Deploy SSL certificates to cloud services.
If your product is not supported by the "cloud product deployment" feature, refer to the product's documentation for deployment instructions. Products that support one-click push are listed in the table below.
"Update existing certificate" in the table below refers to the scenario where a certificate is already deployed on a cloud product and you need to replace it.
Some cloud products support one-click deployment only when you update an existing certificate. For an initial deployment, you must complete the configuration in the cloud product console. For more information, see Method 2: Deploy in the cloud product console. For the support status of each cloud product, see the Applicable condition column in the following table.
Cloud product | Certificate configuration scenario | Applicable condition |
Cloud Web Hosting | Enable HTTPS access for websites | Initial deployment, Update existing certificate |
Container Registry (ACR) | Access a Container Registry Enterprise Edition instance over HTTPS with a custom domain name | Update existing certificate |
Container Service for Kubernetes (ACK) | Update AlbConfig certificates and Secret certificates in ACK managed and dedicated clusters Important Do not manually modify a Secret in ACK. The system creates a new Secret automatically. | Update existing certificate |
Serverless App Engine - gateway routing | Configure HTTPS as the forwarding protocol for gateway routing (ALB and CLB) | Update existing certificate |
Function Compute (FC) | HTTP function scenario | Update existing certificate |
Microservices Engine - cloud-native gateway | Cloud-native gateway routing scenario | Update existing certificate |
Cloud-native API Gateway | Access an API over HTTPS with a domain name | Update existing certificate |
Global Accelerator (GA) | Accelerate HTTPS domain name access securely | Update existing certificate |
| Forward requests over HTTPS using an HTTPS listener (server certificate) Note To deploy a client certificate, see End-to-end HTTPS encryption. | Update existing certificate |
Content Delivery Network (CDN) | HTTPS secure acceleration | Initial deployment, Update existing certificate |
Dynamic Route for CDN (DCDN) | HTTPS secure acceleration | Initial deployment, Update existing certificate |
Edge Security Acceleration (ESA) | HTTPS secure acceleration | Update existing certificate |
Object Storage Service (OSS) | Access OSS over HTTPS Note If your domain name uses CDN acceleration, replace the certificate in the CDN console. | Update existing certificate |
Web Application Firewall (WAF) | CNAME access scenario | Update existing certificate |
Anti-DDoS Pro and Anti-DDoS Premium | Domain name access for Anti-DDoS Pro and Anti-DDoS Premium | Update existing certificate |
ApsaraVideo for Live | HTTPS secure acceleration for stream ingest and playback | Initial deployment, Update existing certificate |
ApsaraVideo for VOD | Content distribution and acceleration | Initial deployment, Update existing certificate |
Platform for AI (PAI) | Elastic Algorithm Service (EAS) model serving: use a custom domain name for a dedicated gateway | Update existing certificate |
Method 2: Deploy in the cloud product console
If a cloud product does not support one-click deployment, or if you want to perform the configuration on the cloud product side, download the certificate files from the certificate list. Then log on to the console of the cloud product to upload and configure the certificate. The following table lists the deployment documentation for each cloud product.
Cloud product | Certificate configuration scenario | Deployment documentation |
Cloud Web Hosting | Enable HTTPS access for websites | |
Container Registry (ACR) | Access a Container Registry Enterprise Edition instance over HTTPS with a custom domain name | Use a custom domain name to access a Container Registry Enterprise Edition instance |
Container Service for Kubernetes (ACK) | Update AlbConfig certificates and Secret certificates in ACK managed and dedicated clusters Important Do not manually modify a Secret in ACK. The system creates a new Secret automatically. | |
Serverless App Engine - gateway routing | Configure HTTPS as the forwarding protocol for gateway routing (ALB and CLB) | |
Function Compute (FC) | HTTP function scenario | |
Microservices Engine - cloud-native gateway | Cloud-native gateway routing scenario | |
Cloud-native API Gateway | Access an API over HTTPS with a domain name | |
Global Accelerator (GA) | Accelerate HTTPS domain name access securely | |
| Forward requests over HTTPS using an HTTPS listener (server certificate) Note To deploy a client certificate, see End-to-end HTTPS encryption. |
|
Content Delivery Network (CDN) | HTTPS secure acceleration | |
Dynamic Route for CDN (DCDN) | HTTPS secure acceleration | |
Edge Security Acceleration (ESA) | HTTPS secure acceleration | |
Object Storage Service (OSS) | Access OSS over HTTPS Note If your domain name uses CDN acceleration, replace the certificate in the CDN console. | |
Web Application Firewall (WAF) | CNAME access scenario |
|
Anti-DDoS Pro and Anti-DDoS Premium | Domain name access for Anti-DDoS Pro and Anti-DDoS Premium | |
ApsaraVideo for Live | HTTPS secure acceleration for stream ingest and playback |
|
ApsaraVideo for VOD | Content distribution and acceleration | |
Platform for AI (PAI) | Elastic Algorithm Service (EAS) model serving: use a custom domain name for a dedicated gateway | |
Website Builder | Enable HTTPS access for websites | |
Enterprise Website Builder | Enable HTTPS access for websites |
Deploy a China Cryptography Standard SSL certificate (SM2, supported only by CDN, DCDN, and Anti-DDoS)
Content Delivery Network (CDN): SetCdnDomainSMCertificate.
Dynamic Route for CDN (DCDN): Configure ShangMi for HTTPS.
Anti-DDoS: Update an HTTPS certificate.
Scenario 2: Deploy the certificate to a self-managed web server
If HTTPS is provided by a web service that you installed on your server, you must deploy the certificate to that web service. Two methods are available:
Automatic deployment: You complete the configuration in the Certificate Management Service console, and the console deploys the certificate to your server. You do not need to log on to each server. This method supports Alibaba Cloud ECS instances, Simple Application Server instances, servers from other cloud providers, and self-managed on-premises servers. The conditions differ for each type of server.
Manual deployment: You download the certificate files, log on to the server, and modify the web service configuration. This method supports all servers. It is also the general-purpose option when the conditions for automatic deployment are not met, for example, when the certificate is a China Cryptography Standard (SM2) certificate.
Deployment tutorials are organized by web server type (such as Nginx, Apache, Tomcat, and IIS) and by operating system. Therefore, first confirm which web service runs on your server. You can check the value of the Server response header in your browser's developer tools, or log on to the server and check which process listens on port 80 or 443. For more information, see How do I view the web server type?.
Method 1: Deploy automatically from the console
You complete the configuration in the Certificate Management Service console, and the console deploys the certificate to your server. You do not need to log on to each server. This improves deployment efficiency and reduces configuration risks. Two options are available, depending on where your server is. Choose an option based on the supported servers and the conditions:
Deployment method | Supported servers | Conditions |
Deploy SSL certificates to ECS and Simple Application Server | Alibaba Cloud ECS, Simple Application Server | Supports only standard SSL certificates (RSA/ECC). |
Server deployment: Deploy an SSL certificate to a cloud or local server | Servers from other cloud providers and self-managed on-premises servers (Alibaba Cloud ECS is also supported) |
|
Method 2: Log on to the server and deploy manually
Download the certificate files, log on to the server, and modify the web service configuration. This method supports all servers. It is also the only way to deploy a China Cryptography Standard SSL certificate. Choose a tutorial based on your web server type and operating system.
Deploy a standard SSL certificate (RSA/ECC):
Server operating system
Deployment tutorial
Linux
Install an SSL certificate on an Nginx or Tengine server (Linux)
Install an SSL certificate on a Spring Boot application (Linux)
Windows
Deploy a China Cryptography Standard SSL certificate (SM2):
Server operating system
Deployment tutorial
Supported brands
Linux
All brands
WoSign
WoSign
Windows
WoSign
NoteAlibaba Cloud currently provides installation tutorials for China Cryptography Standard certificates only for Tengine, Nginx, and Apache servers.The deployment steps may vary based on the version of the operating system and the web server.
Scenario 3: Deploy the certificate to a service on a third-party cloud platform
If the certificate must be deployed to a cloud service on Tencent Cloud, AWS, or Huawei Cloud, you can complete the deployment in the Certificate Management Service console. The following platforms and services are supported:
Tencent Cloud: Content Delivery Network (CDN), Web Application Firewall (WAF), and Classic Load Balancer (CLB). AWS: Amazon CloudFront (CDN) and load balancers (ALB, NLB, and CLB).
Huawei Cloud: Content Delivery Network (CDN) and Elastic Load Balance (ELB).
For more information, see Multi-cloud deployment: Deploy certificates to third-party cloud platforms.
For services that are not listed above, refer to the official documentation of the cloud provider:
Tencent Cloud: SSL Certificate Deployment Guide
Huawei Cloud: SSL Certificate Management User Guide
FAQ
How do I download a root certificate?
To download the root certificate of a certificate brand, see Download and install root certificates.
What do I do if the certificate chain is incomplete or an intermediate certificate is missing?
If the root certificate or an intermediate certificate on the client is missing or expired, see How to resolve an incomplete SSL certificate chain for a website to download and install the missing certificate. Then, try to access the website again.
What do I do if the message "One or more intermediate certificates in the certificate chain are missing" appears when I deploy a certificate?
This message may appear when you deploy an SSL certificate on some server systems, such as IIS on Windows Server 2008 R2. Install the missing root certificate or intermediate certificate on the server.
For a non-SM SSL certificate used by a state-owned enterprise, do I follow the international documentation or the China Cryptography Standard documentation?
Follow the deployment tutorials for standard SSL certificates (RSA/ECC). If the certificate that you applied for is a standard SSL certificate that uses a non-SM algorithm, such as RSA or ECC, deploy and configure it based on international standards, regardless of the type of your enterprise.