SSL certificate PEM format requirements and conversion for DCDN - Edge Security Acceleration

Alibaba Cloud CDN accepts certificates and private keys only in PEM format. This topic describes the format requirements for each certificate type and how to convert DER, P7B (PKCS#7), and PFX (PKCS#12) certificates to PEM.

Certificates from a root CA

Root CA certificates are compatible with web servers such as Apache, IIS, NGINX, and Tomcat. SSL certificates used by CDN use the NGINX-compatible format. The certificate file has a .crt extension and the private key file has a .key extension.

Open the .crt file in a text editor to view the certificate content.

The certificate must match this structure:

Starts with -----BEGIN CERTIFICATE-----
Ends with -----END CERTIFICATE-----
Each line except the last contains exactly 64 characters; the last line can be 64 characters or fewer

Upload the full content from -----BEGIN CERTIFICATE----- through -----END CERTIFICATE-----.

Certificates from an intermediate CA

When your certificate is issued by an intermediate CA, upload the full certificate chain: the server certificate and all intermediate certificates combined into a single file.

-----BEGIN CERTIFICATE-----
(server certificate content)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(intermediate certificate content)
-----END CERTIFICATE-----

Important

The server certificate must come first, followed by intermediate certificates. Do not add space characters between certificates. All certificates must be in PEM format.

To assemble the chain, open each .pem file in a text editor and paste the content in order: server certificate block first, then each intermediate certificate block immediately after, with no spaces between them.

RSA private key format

The private key file has a .pem or .key extension. Open it in a text editor to view its content.

A valid RSA private key must:

Start with -----BEGIN RSA PRIVATE KEY-----
End with -----END RSA PRIVATE KEY-----
Have each line (except the last) contain exactly 64 characters

Generate a new RSA private key

Run the following command to generate a 2048-bit RSA private key. The output is saved to privateKey.pem.

openssl genrsa -out privateKey.pem 2048

Convert a private key that starts with `-----BEGIN PRIVATE KEY-----`

If your private key starts with -----BEGIN PRIVATE KEY----- instead of -----BEGIN RSA PRIVATE KEY-----, convert it with OpenSSL before uploading:

openssl rsa -in old_server_key.pem -out new_server_key.pem

Upload the content of new_server_key.pem along with your certificate.

Convert certificate formats

CDN accepts only PEM-format certificates. Use OpenSSL to convert from other formats.

A .crt file may be in either PEM or Distinguished Encoding Rules (DER) format. Open it in a text editor — if you see -----BEGIN CERTIFICATE-----, it is already in PEM format and no conversion is needed. PEM is a Base64-encoded text format; private key files in PEM format use the .key extension.

DER to PEM

DER is commonly used on Java platforms.

Convert the certificate:

openssl x509 -inform der -in certificate.cer -out certificate.pem

Convert the private key:

openssl rsa -inform DER -outform pem -in privatekey.der -out privatekey.pem

P7B (PKCS#7) to PEM

P7B is commonly used on Windows Server and Tomcat.

Convert the certificate:

openssl pkcs7 -print_certs -in incertificat.p7b -out outcertificate.cer

Open outcertificate.cer and copy the block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----. Upload only that block.

P7B files do not contain a private key. When configuring your SSL certificate in the CDN console, enter only the certificate content and leave the private key field blank.

PFX (PKCS#12) to PEM

PFX is commonly used on Windows Server.

Convert the certificate:

openssl pkcs12 -in certname.pfx -nokeys -out cert.pem

Convert the private key:

openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes