All Products
Search

This Product

    Alibaba Mail:How to upload an SSL certificate?

    Document Center

    Alibaba Mail:How to upload an SSL certificate?

    Last Updated:Sep 09, 2026

    This topic describes how to upload an SSL certificate to Alibaba Mail.

    Why do I need an SSL certificate?

    SSL certificates provide HTTPS encryption for webmail sites and mailbox applications. They encrypt email transmissions to prevent data from being stolen during transmission. The Alibaba Cloud SSL Certificate service provides a comprehensive and convenient solution for website encryption and application security. Hundreds of thousands of enterprise users trust our service.

    Prerequisites

    You have added a CNAME record for the domain name. You can access the Alibaba Mail web client using the format `mail.yourdomain.com`.

    Purchase a domain name certificate for your mailbox

    To purchase a domain name certificate, visit the Alibaba Cloud official website and search for Certificate Management Service. For mailbox applications, you can purchase a GeoTrust OV wildcard certificate.

    image.pngimage.png

    Prepare the SSL certificate for your mailbox domain name

    After you purchase the certificate, Alibaba Cloud provides certificates for different applications, such as Apache, Nginx, and IIS. Simply download the certificate for Apache.

    There are two types of certification authorities (CAs): root CAs and intermediate CAs. Certificates are typically issued by intermediate CAs. Therefore, when you upload the certificate, you must upload the certificate file, the certificate chain, and the private key content.

    image

    • If you receive a .pem file certificate, it has only one private key file and one certificate file. The certificate file contains two parts. Open the certificate file in a text editor. The first part, from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`, is the certificate file content. The second part, from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`, is the certificate chain file content.pom内容

    • If the certificate you receive has one private key file and one certificate file, the certificate file contains two parts. Open the certificate file in a text editor. The first part, from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`, is the certificate file content. The second part, from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`, is the certificate chain file content.imageimage

    Note

    If the certificate file contains multiple sections from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`, the first section is the certificate file content. All subsequent sections form the certificate chain file.

    Upload an SSL certificate

    Log on to the Alibaba Mail domain management platform. Choose Enterprise Customization > Domain Management > SSL Certificate Management > Upload Certificate.证书内容

    • Open the certificate file in a text editor. Copy all content, including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, and paste it into the Certificate File field.

    • Open the certificate chain file in a text editor. Copy all content of the certificate chain, including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`, and paste it into the Certificate Chain File field.

    • Open the private key file in a text editor. Copy all content of the private key, including `-----BEGIN RSA PRIVATE KEY-----` and `-----END RSA PRIVATE KEY-----`, and paste it into the Certificate Private Key field.

    image.png

    Confirm the certificate

    Copy the content of the certificate file, certificate chain file, and private key into the corresponding fields. Click Confirm to submit the certificate.image.png

    After the certificate is uploaded, you can view the information of the certificate in use on the SSL Certificate Management page. The certificate takes up to 24 hours to take effect.

    ee

    If the certificate status is normal but your browser still displays the old certificate when you visit `mail.yourdomain.com`, the issue is usually caused by the browser cache or the local DNS cache. Troubleshoot the issue as follows:

    • Clear the browser cache, visit `mail.yourdomain.com` again, and check whether the new certificate is displayed.

    • Open an incognito window in your browser and visit `mail.yourdomain.com` to verify whether the new certificate has taken effect.

    • On the mail management page, choose Enterprise Customization > Domain Management > SSL Certificate Management to view the certificate status and validity period, and confirm that the certificate has been uploaded.

    • If the new certificate is still not displayed after 24 hours, check whether the DNS records of the domain name point to Alibaba Mail.

    Important

    If the certificate upload fails, the cause might be one of the following issues. Troubleshoot the issue based on the error message and resubmit the correct certificate content.

    1. If the error message "Certificate and key do not match" or "Certificate file can only contain one certificate" appears, try swapping the certificate file and the certificate chain file, and then upload them again.

    2. The certificate chain is incomplete.

    3. The certificate does not match the domain name.

    4. The signature algorithm is insecure. The SHA1 algorithm is not allowed.

    5. The certificate has expired.

    6. The certificate has been revoked.

    7. We recommend using certificates from trusted providers, such as GeoTrust and GlobalSign.

    Use the SSL certificate

    After the domain name certificate is uploaded, you can access the webmail service over HTTPS. Emails are now sent and received with SSL encryption.

    image.png