By default, HTTPS certificates only support one-way authentication where the client verifies the server's identity. Alibaba Cloud CDN supports client certificate authentication, which uses a custom CA certificate to enable the server to verify the client's identity. This implements mutual authentication and enhances website communication security. This topic describes how to enable and configure client certificate authentication.
Prerequisites
You have enabled and configured the HTTPS certificate feature. For more information, see Configure an HTTPS certificate.
You have obtained a self-signed Client CA Certificate.
Procedure
Log on to the CDN console.
In the left navigation pane, click Domain Names.
On the Domain Names page, find the target domain name and click Manage in the Actions column.
In the domain's navigation pane, click HTTPS.
Turn on Client Certificate Authentication and enter your self-signed Client CA Certificate.
Enter the self-signed private certificate (public key). The CA certificate must meet the following format requirements:
The certificate must start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----".
Each line must contain 64 characters. The last line can contain fewer than 64 characters.
Click OK.
After you enable Client Certificate Authentication, when a client sends an HTTPS request to access resources, CDN verifies the validity of the client certificate. If the verification succeeds, the request is allowed. If the verification fails, the request is rejected.