Anti-DDoS:Update an HTTPS certificate in Anti-DDoS Proxy

Usage notes

• Anti-DDoS Proxy (Chinese Mainland)

  • Supports international standard HTTPS certificates and SM (ShangMi) HTTPS certificates using the SM2 algorithm.

    Note

    Anti-DDoS Proxy (Chinese Mainland) supports SM-enabled browsers such as 360 Browser and Honglian Browser.

  • If your website supports both international and SM HTTPS certificates, upload both types.

  • If a client does not support SNI, Anti-DDoS Proxy (Chinese Mainland) returns the default SM certificate and the client displays "The server certificate cannot be trusted."

• Anti-DDoS Proxy (Outside Chinese Mainland)

  Supports international standard HTTPS certificates only.

Update the HTTPS certificate

1. Log on to the Website Config page in the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

3. On the Website Config page, find the target domain name and click Edit in the Actions column.

4. Update the international standard HTTPS certificate.

   On the Modify Website Configurations tab, click Modify next to the current certificate.

   • Upload: Enter a Certificate Name, paste the certificate content into Certificate File, and paste the private key into Private Key.

     Note

     • For PEM, CER, or CRT formats, open the file in a text editor and copy the content. For other formats such as PFX or P7B, convert to PEM first. For more information, see Convert certificate formats or How do I convert an SSL certificate to the PEM format?

     • If the certificate file contains a certificate chain, concatenate all certificates and paste the combined content into Certificate File.

   • Select Existing Certificate: Select a certificate already uploaded to Certificate Management Service.

5. Update the SM certificate. This step applies only to Anti-DDoS Proxy (Chinese Mainland).

   On the Modify Website Configurations tab, configure the SM certificate in the SM Certificate section.

   • Allow Access Only from SM Certificate-based Clients: Off by default. Options:

     • On: Accepts only SM-certificate clients.

       Note

       When enabled, TLS suites, mutual authentication, and OCSP stapling settings for international standard HTTPS certificates do not take effect.

     • Off: Accepts clients with either an SM or international standard certificate.

   • SM Certificate: Select an SM certificate from the list. Upload the certificate to Certificate Management Service first.

   • SM Cipher Suites for HTTPS Support: The following cipher suites are enabled by default (not configurable):

     • ECC-SM2-SM4-CBC-SM3

     • ECC-SM2-SM4-GCM-SM3

     • ECDHE-SM2-SM4-CBC-SM3

     • ECDHE-SM2-SM4-GCM-SM3

6. Click Next and follow the prompts to complete the update.

Verify the result

Verify the new certificate is active after the update.

• Visit your website over HTTPS (for example, https://your-domain) and check the certificate details in your browser.

• Run the following command to verify the certificate information:

  openssl s_client -connect your-domain:443

  Replace your-domain with your actual domain name and check the certificate details in the output.

FAQ

• How do I handle a mismatch between a certificate and its private key?

• How does Anti-DDoS Proxy ensure the security of uploaded certificates and private keys?