CDN:Certificate formats

Before you upload

Make sure your certificate and private key meet all of the following requirements before uploading:

Certificates from a root CA

Root CA certificates are compatible with web servers such as Apache, IIS, NGINX, and Tomcat. SSL certificates used by CDN use the NGINX-compatible format. The certificate file has a .crt extension and the private key file has a .key extension.

Open the .crt file in a text editor to view the certificate content.

The certificate must match this structure:

• Starts with -----BEGIN CERTIFICATE-----

• Ends with -----END CERTIFICATE-----

• Each line except the last contains exactly 64 characters; the last line can be 64 characters or fewer

Upload the full content from -----BEGIN CERTIFICATE----- through -----END CERTIFICATE-----.

Certificates from an intermediate CA

When your certificate is issued by an intermediate CA, upload the full certificate chain: the server certificate and all intermediate certificates combined into a single file.

-----BEGIN CERTIFICATE-----
(server certificate content)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(intermediate certificate content)
-----END CERTIFICATE-----

To assemble the chain, open each .pem file in a text editor and paste the content in order: server certificate block first, then each intermediate certificate block immediately after, with no spaces between them.

RSA private key format

The private key file has a .pem or .key extension. Open it in a text editor to view its content.

A valid RSA private key must:

• Start with -----BEGIN RSA PRIVATE KEY-----

• End with -----END RSA PRIVATE KEY-----

• Have each line (except the last) contain exactly 64 characters

Generate a new RSA private key

Run the following command to generate a 2048-bit RSA private key. The output is saved to privateKey.pem.

openssl genrsa -out privateKey.pem 2048

Convert a private key that starts with `-----BEGIN PRIVATE KEY-----`

If your private key starts with -----BEGIN PRIVATE KEY----- instead of -----BEGIN RSA PRIVATE KEY-----, convert it with OpenSSL before uploading:

openssl rsa -in old_server_key.pem -out new_server_key.pem

Upload the content of new_server_key.pem along with your certificate.

Key length requirements

The supported RSA private key length range for CDN is as follows:

• RSA keys shorter than 2048 bits (such as 1024 bits) are considered insecure and may be rejected by backend validation.

• Use 2048 bits or 4096 bits. Generate a key with

  openssl genrsa -out privateKey.pem 2048

  or replace 2048 with 4096.

• CDN also supports ECC (Elliptic Curve Cryptography) certificates. Common ECC curve types include prime256v1 (secp256r1) and secp384r1. Generate an ECC private key with:

openssl ecparam -genkey -name prime256v1 -out ecc_key.pem

Convert certificate formats

CDN accepts only PEM-format certificates. Use OpenSSL to convert from other formats.

A .crt file may be in either PEM or Distinguished Encoding Rules (DER) format. Open it in a text editor — if you see -----BEGIN CERTIFICATE-----, it is already in PEM format and no conversion is needed. PEM is a Base64-encoded text format; private key files in PEM format use the .key extension.

openssl x509 -inform der -in certificate.cer -out certificate.pem

openssl rsa -inform DER -outform pem -in privatekey.der -out privatekey.pem

openssl pkcs7 -print_certs -in incertificat.p7b -out outcertificate.cer

openssl pkcs12 -in certname.pfx -nokeys -out cert.pem

openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes

Signature algorithm support

The signature algorithms supported by CDN depend on the backend API validation rules. Below is a compatibility reference for common signature algorithms:

• Recommended signature algorithms:

  • SHA-256 with RSA (sha256WithRSAEncryption)

  • SHA-384 with RSA

  • SHA-512 with RSA

  • ECDSA with SHA-256 (for ECC certificates)

• Not recommended:

  • SHA-1 with RSA: SHA-1 has been marked insecure by major browsers, and some backend validations may reject SHA-1 signed certificates.

You can check your certificate's signature algorithm with:

openssl x509 -in your_cert.pem -noout -text | grep "Signature Algorithm"

The output should look like Signature Algorithm: sha256WithRSAEncryption.