Edge Security Acceleration:Configure edge certificates

Certificate types

ESA supports free and custom certificates. Free certificates are automatically issued and renewed by trusted certification authorities (CAs) such as Let's Encrypt. Custom certificates allow you to upload enterprise certificates, such as those from GlobalSign, for branding or compliance needs. You must manage the renewal of custom certificates.

• If you run a website for a small-to-medium business or a personal blog with a single exact-match domain name, we recommend applying for a free certificate.

• If you require a certificate from a highly trusted certification authority (CA) or already have a certificate for your domain name, we recommend uploading a custom certificate.

Apply for a free certificate

The free certificate feature simplifies certificate management. Enter your domain name, and the system automatically handles the application, domain control validation (DCV), renewal, and deployment.

1. In the ESA console, select Websites, and in the Website column, click the target website.

2. In the navigation pane on the left, choose Edge Certificates.

3. In the Certificate Management section, click Apply for Free Certificate. Select a Certificate Authority and enter a Domain Name:

   • Let's Encrypt (No SLA): Each free certificate can include a maximum of 50 domains. You can enter single domains and wildcard domains. A wildcard domain must start with *, and the domains must match the website. A certificate for example.com covers only that domain and does not include subdomains, such as www.example.com. To cover subdomains such as www.example.com, you must apply for a separate wildcard certificate (*.example.com) or add the subdomain separately.

   • DigiCert: For a Digicert single-domain certificate, you can select only one website domain. After you apply for a certificate for example.com, the issued certificate will include both example.com and www.example.com. If you use a subdomain to access ESA (such as www.example.com), you must perform domain control validation for the root domain (such as example.com) when you apply for a Digicert certificate.

4. Click OK and wait for the certificate application to complete. After the certificate is successfully issued, its status in the Status column changes to Normal.

   

Upload a custom certificate

You can deploy certificates from Alibaba Cloud Certificate Management Service or a third-party provider to ESA.

1. In the ESA console, select Websites, and in the Website column, click the target website.

2. In the navigation pane on the left, choose Edge Certificates.

3. In the Certificate Management section, click Upload Custom Certificate.

   • If you purchased a certificate from Certificate Management Service, set Certificate Source to Certificate Purchased by Using Certificate Management Service, and select your certificate from the Certificate Name drop-down list.

     Note

     If your certificate is not in the list, verify that the domain name bound to the certificate matches the acceleration domain name.

   • If you are using a certificate from a third-party provider, set Certificate Source to Custom Certificate. Then, enter a Certificate Name and paste the content of your Certificate (Public Key) and Private Key. The certificate is saved in Certificate Management Service. You can view it in SSL Certificate Management.

     Parameter	Description
     Certificate Name	Enter a name for the certificate. You can use letters, periods, numbers, underscores _, and hyphens -. Note The certificate name must be unique. You can view your existing certificates in SSL Certificate Management. If the system indicates that the name is a duplicate, enter a different name and upload the certificate again.
     Certificate (Public Key)	Paste the PEM-encoded content of your certificate file. You can use a text editor to open the PEM-formatted certificate file, copy its content, and paste it into this field.
     Private Key	Paste the PEM-encoded content of your certificate's private key. You can use a text editor to open the PEM-formatted private key file, copy its content, and paste it into this field.

4. Click OK to upload the certificate.

Update an existing certificate

1. In the ESA console, select Websites, and in the Website column, click the target website.

2. In the navigation pane on the left, choose Edge Certificates.

3. In the Certificate Management section, find the certificate that you want to update, and click Modify in the Certificate Management column.

4. Update the certificate content as needed, and then click OK.

Configure a new certificate

1. In the ESA console, select Websites, and in the Website column, click the target website.

2. In the navigation pane on the left, choose Edge Certificates.

3. In the Certificate Management section, click Upload Custom Certificate. Based on the Certificate Source, enter the required information, and then click OK.

4. After confirming that the new certificate is uploaded, find the expiring certificate and click Delete in the Actions column. Follow the on-screen prompts to delete the certificate.

Automatic domain control validation for free certificates

To verify domain ownership, certification authorities (CAs) require applicants to complete validation using one of the following methods:

• DNS validation (for websites added by using NS records): After applying for a free certificate, ESA automatically adds a TXT record to your DNS configuration for domain control validation.

• HTTP validation (for websites added by using CNAME records): After applying for a free certificate, domain control is confirmed by verifying that a specific file can be placed on the web server of the specified domain.

When you apply for a free certificate for a website that is active in ESA, ESA handles domain control validation (DCV) by using hosted DCV.

Certificate selection priority

If a website has multiple certificates in its certificate pool, an edge point of presence (POP) selects the optimal one to send to the client based on the following priority:

• Available certificates are prioritized, such as certificates that are within their validity period and match the SNI.

• Newer certificates are prioritized over older ones.