All Products
Search

This Product

    Alibaba Cloud Service Mesh:Manage TLS certificates in ASM

    Document Center

    Alibaba Cloud Service Mesh:Manage TLS certificates in ASM

    Last Updated:Jun 20, 2026

    ASM certificate management synchronizes certificates across all clusters within a mesh, an ideal approach for multi-cluster scenarios. It also simplifies certificate maintenance with information displays and expiration alerts. This topic describes how to use the certificate management feature in ASM.

    Prerequisites

    Step 1: Prepare a server certificate and private key

    1. Run the following command to create a root certificate and a private key.

      openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=myexample Inc./CN=aliyun.com' -keyout aliyun.root.key -out aliyun.root.crt

    2. Run the following commands to generate a certificate and a private key for the aliyun.com server. The certificate is valid for 365 days.

      openssl req -out aliyun.com.csr -newkey rsa:2048 -nodes -keyout aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 365 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in aliyun.com.csr -out aliyun.com.crt

    3. Run the following commands to generate an expiring certificate and a private key for the aliyun.com server. The certificate is valid for one day.

      This one-day certificate is used to test the certificate expiration alert feature of ASM.

      openssl req -out expiring.aliyun.com.csr -newkey rsa:2048 -nodes -keyout expiring.aliyun.com.key -subj "/CN=aliyun.com/O=myexample organization"
openssl x509 -req -days 1 -CA aliyun.root.crt -CAkey aliyun.root.key -set_serial 0 -in expiring.aliyun.com.csr -out expiring.aliyun.com.crt

    (Optional) Step 2: Enable control-plane log collection and certificate alerts

    You can enable control-plane log collection and set up alerts for expired certificates and certificates that are about to expire. ASM considers a certificate "about to expire" if its validity period is less than 30 days.

    On the Control-plane Log Alert Settings page, find the certificate-related alert policies (Expired certificate exists in certificate management and Certificate that is about to expire exists in certificate management), click Enable Alert to the right of each policy, and select Service Mesh ASM Built-in Action Policy (Recommended).

    Step 3: Create certificates

    1. Create a standard certificate.

      1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

      2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Gateways > Certificate Management.

      3. On the Certificate Management page, click Create. In the Certificate Information panel, configure the parameters and click OK.

        Parameter

        Description

        Name

        A custom name for the certificate.

        Namespaces

        Default: istio-system.

        Public Key Certificate

        The content of the aliyun.com.crt file generated in Step 2 of Step 1.

        Private Key

        The content of the aliyun.com.key file generated in Step 2 in Step 1.

        Enable mTLS

        For mTLS communication, enable this option and provide the content of your CA certificate in the CA Certificate text box.

    2. Refer to Step 1 and create a certificate that is about to expire.

      For the Public Key Certificate and Private Key, use the content from the expiring.aliyun.com.crt and expiring.aliyun.com.key files generated in Step 3 in Step 1, respectively. After the certificates are created, the Certificate Management page displays two new certificate records: expiring-cert with a status of Normal and test-cert with a status of Expiring soon. The domain name for both certificates is aliyun.com, and the type is TLS. In the Operation column, you can click Details to view the details of a certificate or click Edit to modify its content.

    3. (Optional) View certificate alert logs.

      Before 1.17.2.35

      1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

      2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose ASM Instance > Base Information.

      3. In the Config Info section, to the right of Control-plane log collection, click View log. In the Logstores list on the left, click internal-alert-history. On the internal-alert-history page, search for certificate alert logs by entering the keyword certificate, selecting 30 Days (Relative) for the time range, and clicking Query/Analyze. The query results show a total of 28 alert logs, including alert records where AlertDisplayName is "certificate about to expire".

      1.17.2.35 and later

      1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

      2. On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Observability Management Center > Log Center.

      3. On the Log Center page, click the Control-Plane Logs tab. Enter Certificate in the search box and click Query/Analysis to view the alert logs.

      Note

      ASM checks for certificate expiration alerts every 6 hours. If no alert logs appear, wait 6 hours and check again.

    4. Use certificates from certificate management.

      After you create certificates on the Certificate Management page, you can reference them directly in the following scenarios:

      • When you create or modify a Gateway resource by using YAML, you can set the credentialName field to the certificate's name to configure TLS. For more information, see Manage a Gateway.

      • When you create a Gateway resource by using the GUI in the ASM console, you can select a certificate from Certificate Management. For more information, see Manage a Gateway.

      • When you create a domain on the Domain/Certificate page of the gateway overview, you can directly reference a certificate from Certificate Management for TLS configuration. For more information, see Add a Certificate for a Domain.

    Step 4: Certificate migration

    Starting from version 1.17, ASM supports certificate management on the ASM Gateway > Certificate Management page. If you have created certificates on the gateway overview's Domain/Certificate page, migrate them to the Certificate Management page.

    On the Certificate Management page, create a certificate with the same name and paste the information from the original certificate. This action transfers the certificate's management to the Certificate Management page.