Supported certificate formats and conversion methods-ApsaraVideo VOD(VOD)-阿里云帮助中心

Root CA certificates

A root certificate is a unique public key certificate issued by a root certificate authority (CA). Root certificates can be used on various server types, including Apache, Internet Information Services (IIS), NGINX, and Tomcat. ApsaraVideo VOD uses NGINX servers to manage certificates.

The certificate information is contained in a .crt file and the private key information is contained in a .key file.

Upload your certificate in the following format:

The certificate must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.
All the lines except the last line must be 64 characters in length. The last line can be up to 64 characters in length.

The following figure shows a sample PEM certificate in the Privacy-Enhanced Mail (PEM) format on a Linux system.

Intermediate CA certificates

A certificate file issued by an intermediate CA contains one server certificate and one intermediate certificate. You must concatenate the server certificate and the intermediate certificate before uploading them.

Note

The server certificate content must precede the intermediate certificate content. The CA typically provides concatenation instructions when issuing certificates. Follow those instructions to concatenate the certificates.

A certificate chain issued by an intermediate CA uses the following format:

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

The certificate chain must comply with the following rules:

Empty lines are not allowed between certificates.
Each certificate must follow the required format when uploaded.

Format rules of RSA private keys

A Rivest-Shamir-Adleman (RSA) private key must comply with the following rules:

The openssl genrsa -out privateKey.pem 2048 command must be run to generate the RSA private key. privateKey.pem is the private key file.
The private key must start with -----BEGIN RSA PRIVATE KEY----- and end with -----END RSA PRIVATE KEY-----.
All the lines except the last line must be 64 characters in length. The last line can be up to 64 characters in length.

If the private key does not start with -----BEGIN PRIVATE KEY----- or end with -----END PRIVATE KEY-----, run the following command to convert the private key:

openssl rsa -in old_server_key.pem -out new_server_key.pem

Then, upload the new_server_key.pem file and the certificate.

Certificate format conversion

HTTPS configuration supports only PEM certificates. If your certificates are in a different format, convert them to PEM by using OpenSSL.

Conversion from the DER format to the PEM format
The Distinguished Encoding Rules (DER) format is typically used for Java.
- Certificate conversion:
```
openssl x509 -inform der -in certificate.cer -out certificate.pem
```
- Private key conversion:
```
openssl rsa -inform DER -outform pem -in privatekey.der -out privatekey.pem
```
Conversion from the P7B format to the PEM format
The P7B format is typically used for Windows Server and Tomcat.
- Certificate conversion:
```
openssl pkcs7 -print_certs -in incertificat.p7b -out outcertificate.cer
```
  Open the outcertificat.cer file. Then, copy and paste the part that starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- as the certificate content.
- Private key conversion: P7B certificates do not include a private key. When you configure an HTTPS certificate in the ApsaraVideo VOD console, you only need to provide the certificate content, not the private key.
Conversion from the PFX format to the PEM format
The PKCS #12 (PFX) format is typically used for Windows Server.
- Certificate conversion:
```
openssl pkcs12 -in certname.pfx -nokeys -out cert.pem
```
- Private key conversion:
```
openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes
```