HTTPS encrypts data in transit over HTTP by using the TLS/SSL protocol, which effectively prevents data from being eavesdropped on, intercepted, or tampered with by third parties. You can configure an HTTPS certificate on DCDN to encrypt requests between clients and DCDN over HTTPS to ensure the security of data transmission.
Why HTTPS encryption is required
HTTPS secure transmission effectively prevents the risks of eavesdropping, tampering, spoofing, and hijacking in HTTP plaintext transmission. Your critical information is encrypted during data transmission, which prevents security risks such as the leakage of sensitive information caused by attackers capturing Session IDs or cookies.
HTTPS is the mainstream trend. If you continue to use the HTTP protocol, in addition to potential security risks, the insecure warnings that end users see when they visit your website affect the user experience.
Major search engines give search weighting to HTTPS websites. Websites accessed over HTTPS get higher search rankings.
SSL/TLS certificates
SSL (Secure Sockets Layer) is a security protocol that sits between TCP/IP and various application layer protocols. Clients (such as browsers) can use it to verify the authenticity and integrity of the servers they connect to, and exchange information using encryption.
After IETF standardized SSL, it was renamed TLS (Transport Layer Security). The two are therefore commonly referred to together as SSL/TLS.
SSL certificates use the SSL protocol for communication. They are trusted credentials issued to websites by authoritative organizations, and serve the dual purposes of website identity verification and encrypted transmission.
Billing
HTTPS secure acceleration is a value-added feature. After you enable HTTPS, you are charged based on the number of HTTPS requests. For more information, see Billing of HTTPS and HTTP requests.
HTTPS requests are separately billed, and the fees cannot be offset by data transfer plans of Dynamic Content Delivery Network (DCDN). Make sure that you have a sufficient balance in your Alibaba Cloud account. Otherwise, overdue payments may occur and cause service suspension.
End-to-end data transfer over HTTPS
When a client sends a request to a server, the HTTPS encryption process is shown in the following figure:
-
Configure an SSL certificate for your domain name in the DCDN console to allow HTTPS connections between clients and points of presence (POPs).
NoteHTTPS secure acceleration is a value-added feature that is billed based on the number of HTTPS requests. For more information, see Billing of HTTPS and HTTP requests.
-
Configure an SSL certificate on the origin server and configure origin fetch over HTTPS. For more information, see Configure the static origin protocol policy.
NoteIf you want to implement end-to-end data transfer over HTTPS, make sure that the origin server supports HTTPS before you configure origin fetch over HTTPS. For more information, see Configure the static origin protocol policy.
Configure HTTPS secure acceleration between clients and POPs
Step 1: Prepare a certificate for the accelerated domain name
Only certificates in the PEM format are supported. You can convert certificates in other formats to the PEM format. For more information, see Convert certificate formats.
You can apply for an individual test certificate (free) or purchase a certificate in the Certificate Management Service console.
You can also apply for a certificate from a third-party CA. The issued certificate must meet the certificate format requirements. For more information, see Certificate formats.
Step 2: Enable HTTPS secure acceleration
-
Required. After you prepare an SSL certificate, configure the certificate for the accelerated domain name before you enable HTTPS secure acceleration. For more information, see Configure an HTTPS certificate.
-
Optional. Configure more features based on your business requirements.
Category
Feature
Description
Configure client access protocols
By configuring Protocol Redirect, you can redirect HTTP requests from clients to DCDN nodes to HTTPS requests, or redirect HTTPS requests to HTTP requests as needed.
Forces clients to use HTTPS to establish connections with DCDN nodes, reducing the risk of first-visit hijacking.
Specify the protocol version
HTTP/2 (HTTP2.0) is the new HTTP protocol following HTTP1.1. It supports the latest features such as binary framing, multiplexing, and header compression, which can significantly improve web performance and reduce data interaction latency.
After the TLS version is specified, clients can only use the corresponding TLS version to send and receive requests with DCDN nodes, meeting the security requirements of the communication link.
Accelerate the validation of the SSL certificate
DCDN nodes pre-cache online certificate verification results and deliver them to clients, so browsers do not need to query the CA site directly for certificate status, reducing user verification time.