Edge Security Acceleration:Configure edge certificates

Certificate types

ESA supports both free and custom certificates. Free certificates are automatically issued and renewed by trusted certification authorities (CAs) such as Let's Encrypt, making them ideal for quickly enabling HTTPS encryption. Custom certificates allow you to upload your own enterprise certificates, such as those issued by GlobalSign, to meet branding or compliance requirements. You are responsible for managing the validity and renewal of custom certificates.

• If you have a small-to-medium enterprise website or a personal blog that uses a single exact-match domain name, we recommend that you apply for a free certificate.

• If you need a certificate from a specific certification authority (CA) or already have one, upload a custom certificate.

Apply for a free certificate

The free certificate feature simplifies certificate issuance and management. You can enter your domain name to automatically complete the certificate application, domain control validation (DCV), renewal, and deployment.

1. In the ESA console, select Websites. In the Website column, click the target website.

2. In the left-side navigation pane, choose Edge Certificates.

3. In the Certificate Management area, click Apply for Free Certificate. Select a Certificate Authority and enter a Domain Name:

   • Let's Encrypt (No SLA): Each free certificate can include up to 50 domain names. You can enter single domain names and wildcard domain names. A wildcard domain name must start with *. The domain names must match the website. A certificate for example.com covers only that domain name and does not include subdomains such as www.example.com. To cover subdomains such as www.example.com, you must apply for a separate wildcard domain name certificate (*.example.com) or add the subdomain as an additional domain name.

   • DigiCert: You can select only one website domain for a Digicert single-domain certificate. If you apply for a certificate for example.com, the issued certificate will include both example.com and www.example.com.

4. Click OK and wait for the certificate application to complete. After the certificate is successfully issued, its status in the Status column changes to Normal.

   

Upload a custom certificate

You can deploy certificates to ESA from Alibaba Cloud Certificate Management Service or third-party providers.

1. In the ESA console, select Websites. In the Website column, click the target website.

2. In the left-side navigation pane, choose Edge Certificates.

3. In the Certificate Management area, click Upload Custom Certificate.

   • If you purchased a certificate from Alibaba Cloud Certificate Management Service, set Certificate Source to Certificate Purchased by Using Certificate Management Service and select your certificate from the Certificate Name drop-down list.

     Note

     If you cannot find your certificate in the list, check whether the domain name bound to the certificate is the same as the domain name of the website.

   • If you are using a certificate from a third-party provider, set Certificate Source to Custom Certificate. Then, enter a Certificate Name and paste the content of your Certificate (Public Key) and Private Key. The certificate is saved in Certificate Management Service. You can view it in SSL Certificate Management.

     Parameter	Description
     Certificate Name	Enter a name for the certificate you want to upload. You can use letters, periods, numbers, underscores _, and hyphens -. Note The certificate name must be unique. You can view existing certificates in SSL Certificate Management. If the system reports a duplicate name, change the name and try again.
     Certificate (Public Key)	Paste the PEM-encoded content of your certificate file. You can use a text editor to open the PEM-formatted certificate file, and then copy and paste the content into this field.
     Private Key	Paste the PEM-encoded content of your certificate's private key. You can use a text editor to open the PEM-formatted private key file, and then copy and paste the content into this field.

4. Click OK to upload the certificate.

Update an existing certificate

1. In the ESA console, select Websites. In the Website column, click the target website.

2. In the left-side navigation pane, choose Edge Certificates.

3. In the Certificate Management area, find the certificate that you want to update and click Modify in the Actions column.

4. Update the certificate content as needed, and then click OK.

Configure a new certificate

1. In the ESA console, select Websites. In the Website column, click the target website.

2. In the left-side navigation pane, choose Edge Certificates.

3. In the Certificate Management area, click Upload Custom Certificate. Enter the required information based on the Certificate Source, and then click OK.

4. After uploading the new certificate, find the expiring certificate in the list and click Delete in the Actions column. Follow the on-screen prompts to delete the old certificate.

Automatic domain control validation for free certificates

Certification authorities (CAs) require applicants to complete a validation process to verify domain ownership. ESA supports the following methods:

• DNS validation (for websites that use NS record integration): After applying for a free certificate, ESA automatically adds a TXT record to your DNS configuration to complete the domain control validation (DCV).

• HTTP validation (for websites added by using CNAME): After you apply for a free certificate, this method confirms your domain control by verifying that you can place a specific file on the web server for the specified domain.

When you apply for a free certificate for a website that is active in ESA, ESA automatically handles the domain validation process by using hosted DCV.

Certificate selection priority

When an edge point of presence (POP) receives a client request, it selects the optimal certificate from the pool based on the following priority:

• Active certificates that match the client's Server Name Indication (SNI) request are prioritized.

• More recently configured certificates are prioritized over older ones.