HTTPS secures data transmission using the SSL or TLS protocol. ApsaraVideo Live provides an HTTPS secure acceleration solution with flexible certificate management to ensure the security and reliability of your live streaming service.
Function Introduction
Hypertext Transfer Protocol Secure (HTTPS) is an HTTP channel secured through encapsulation by the SSL or TLS protocol. ApsaraVideo Live offers an HTTPS secure acceleration solution and supports viewing, disabling, enabling, and editing certificates. When a certificate is correctly configured and enabled, both HTTP and HTTPS access are supported. If the certificate is mismatched or disabled, only HTTP access is supported.
Benefits of HTTPS acceleration
Encrypts users’ critical information during transmission, preventing sensitive data leaks such as session IDs or cookies captured by attackers.
Verifies data integrity during transmission, protecting against man-in-the-middle (MITM) attacks such as DNS hijacking or content tampering by third parties.
Notes
Configuration-related
Feature | Description |
Disabled and Enabled HTTPS |
|
View certificate | You can view the certificate, but private key viewing is not supported because private keys contain sensitive information. Safeguard your certificate details carefully. |
Edit certificate | You can edit the certificate. Note that changes take effect in 5 minutes. Proceed with caution. |
Certificate-related
ApsaraVideo Live supports two types of certificate deployment: Alibaba Cloud SSL certificates and custom certificates.
To enable Enable HTTPS for an accelerated domain name, upload a matching certificate and private key in PEM format.
ApsaraVideo Live uses Tengine, which is based on Nginx. Therefore, it only supports certificates readable by Nginx—specifically, PEM format.
Only SSL or TLS handshakes with SNI information are supported.
The uploaded certificate and private key must match. Otherwise, validation fails.
Certificate updates take effect in 5 minutes.
Password-protected private keys are not supported.
Certificate and domain matching rules
When configuring an HTTPS certificate for a live streaming domain, ensure that the certificate's domain coverage matches your actual business domain. Otherwise, certificate selection may fail or HTTPS may not take effect. Note the following rules:
Domain level matching — The certificate's applicable domain must match the level of your business domain. For example, if your live streaming domain is a third-level domain such as
live.example.com, select a certificate that explicitly covers this third-level domain.Wildcard certificate scope — A wildcard certificate such as
*.example.comcan typically match only its immediate single-level subdomains and does not support cross-level matching for multi-level subdomains such as*.s2.example.comor deeper levels. If your business domain has a multi-level subdomain structure, apply for a wildcard certificate at the corresponding level or a multi-domain certificate.
Configure HTTPS secure acceleration
Step 1: Purchase a certificate
To enable Enable HTTPS, you need a certificate that matches your accelerated domain name. You can go to SSL Certificate and click Buy Now to purchase a certificate. Skip this step if you already have a custom certificate.
Step 2: Configure your live streaming domain
Enable HTTPS secure acceleration.
Log on to the ApsaraVideo Live console.
In the navigation pane on the left, click Domain Names to go to the Domain Management page.
Select the ingest domain you want to configure for HTTPS secure acceleration and click Domain Settings.
Click HTTPS and turn on the HTTPS Certificate switch.
Select a certificate.
SSL Certificate: Under Certificate Type, click Alibaba Cloud Security and choose a certificate you purchased from SSL Certificate. Select the appropriate certificate by name for your accelerated domain.
Custom certificate: Under Certificate Type, click Others, enter a certificate name, and upload your certificate and private key. The certificate will be saved in the SSL Certificate console under Certificate Application Repository.
NoteOnly PEM format certificates are supported.
If your live streaming domain and SSL certificate belong to different Alibaba Cloud accounts, download the certificate in Nginx format (which includes the certificate file and private key file) from the account that owns the certificate. Then, in the HTTPS configuration of the ApsaraVideo Live console, select Others and manually paste the certificate content and private key content to complete the binding.
Step 3: Verify that the certificate is active
After configuration, the certificate takes about 1 minute to propagate globally. Access your resource using HTTPS. If a lock icon appears in your browser, HTTPS secure acceleration is active. Click the lock icon in the address bar. If the panel shows Connection is secure, the certificate is active.
Certificate format reference
This section describes the certificate formats supported by ApsaraVideo Live and how to convert between formats.
Certificates issued by root certificate authorities
Each certificate issued by a root certificate authority is unique and can be used with multiple server software platforms, including Apache, IIS, Nginx, and Tomcat. ApsaraVideo Live typically uses Nginx servers to handle certificates. Certificate files usually use the .crt extension, and private key files usually use the .key extension.
Certificate upload format:
Include the header
-----BEGIN CERTIFICATE-----and footer-----END CERTIFICATE-----.Each line must be 64 characters long, except the last line, which may be shorter.
In a Linux environment, an example of a certificate in PEM format is as follows.
-----BEGIN CERTIFICATE-----
MIIDRjCCAq+gAwIBAgIJAJn3ox4K13xxx
xxx
-----END CERTIFICATE-----Certificates issued by intermediate certificate authorities
Certificates from intermediate authorities include multiple certificates. Upload them together by concatenating the server certificate and intermediate certificate.
Concatenation rule: Place the server certificate first, followed by the intermediate certificate. Certificate issuers usually provide specific instructions—follow them carefully.
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
Certificate chain rules:
Do not leave blank lines between certificates.
Each certificate must follow the standard upload format.
RSA private key format requirements
RSA private key rules:
To generate a private key locally, run:
openssl genrsa -out privateKey.pem 2048. Here,privateKey.pemis your private key file.The key must start with
-----BEGIN RSA PRIVATE KEY-----and end with-----END RSA PRIVATE KEY-----. Upload the entire content.Each line must be 64 characters long, except the last line, which may be shorter.
-----BEGIN RSA PRIVATE KEY-----
MIICXAIBAAKBgQDOOkt3vfjY9...
...（Private key content）...
-----END RSA PRIVATE KEY-----If you did not generate the private key using the method described above and instead obtained a private key in a format such as -----BEGIN PRIVATE KEY----- or -----END PRIVATE KEY-----, you can transform it as follows:
openssl rsa -in old_server_key.pem -out new_server_key.pemThen upload the contents of new_server_key.pem along with your certificate.
Certificate format conversion methods
HTTPS configuration only supports PEM-formatted certificates. Convert other formats to PEM using the OpenSSL tool. The following table shows common conversion methods.
Conversion method | Description |
DER to PEM | DER format is commonly used in Java platforms.
|
P7B to PEM | P7B format is commonly used in Windows Server and Tomcat.
|
PFX to PEM | PFX format is commonly used in Windows Server.
|