All Products
Search

This Product

    Object Storage Service:Access OSS over HTTPS

    Document Center

    Object Storage Service:Access OSS over HTTPS

    Last Updated:Oct 28, 2026

    Domain names provided by OSS support HTTPS access by default. When you access OSS by using a custom domain name, you must configure an SSL certificate for the domain name to enable HTTPS encrypted transmission. This protects data security and helps meet compliance requirements.

    How it works

    HTTPS uses TLS/SSL encryption to encrypt data end to end and uses certificate chains to verify server identity, ensuring the confidentiality, integrity, and authentication of transmitted data. HTTPS access to OSS depends on configuring a valid SSL certificate for the access domain name in the correct place. The supported approach varies by domain name type:

    • OSS bucket domain names: formatted as <bucket-name>.oss-<region-id>.aliyuncs.com , these domain names are managed by Alibaba Cloud with unified SSL certificates and natively support HTTPS. No additional configuration is required, and you can access them directly by using the https:// prefix.

    • Custom domain names: You must configure an SSL certificate for the domain name.

    Enable HTTPS access

    Where you configure the certificate depends on whether CDN acceleration is enabled.

    • CDN acceleration disabled: Traffic reaches OSS directly. You must configure certificate hosting for the custom domain name in the OSS console.

    • CDN acceleration enabled: Traffic is forwarded to OSS through CDN points of presence (POPs) first. You must configure an HTTPS certificate for the CDN-accelerated domain name in the CDN console.

    Use either of the following methods to check whether CDN acceleration is enabled for a custom domain name:

    OSS console

    1. Go to the Buckets page and click the target bucket.

    2. In the left-side navigation pane, click Bucket Settings > Domain Names.

      The domain list shows the domain names that are bound to the bucket. If Alibaba Cloud CDN shows Configured for a domain name, the HTTPS certificate of the domain name must be managed in the CDN console.

    CDN console

    Go to the CDN Domain Names page to view the CDN-accelerated domain names that are configured and in effect, and the origin buckets of the domain names.

    Step 1: Configure an SSL certificate

    Choose the corresponding method to configure an SSL certificate based on the access path of the custom domain name.

    OSS custom domain name

    Applies to scenarios in which a custom domain name is resolved by CNAME to an OSS bucket domain name.

    Important

    Before you begin, make sure that:

    1. Go to the Buckets page, click the target bucket, and then in the left-side navigation pane, click Bucket Settings > Domain Names.

    2. In the Actions column of the target custom domain name, click Upload Certificate to open the certificate hosting panel.

    3. From the Certificate Name drop-down list, select the SSL certificate that matches the domain name. After you select a certificate, the Public Key box is automatically filled with the PEM-encoded content of the certificate. The private key is not displayed.

      If no certificate is available in the drop-down list, click Upload SSL Certificate to obtain a certificate in SSL Certificates Service, and then return to this page and select the certificate again.

    4. If you want to upload a third-party certificate directly, from the Certificate Source drop-down list, select Custom Certificate (Public Key+Private Key), and then enter the PEM-encoded certificate content in the Public Key box and the private key in the Private Key box. You can also select Show PEM Encoding Example to view a format example.

    5. Click Upload to finish the certificate hosting configuration. After the configuration takes effect, the domain name can be accessed over HTTPS.

    Note

    If no certificate is available in the Certificate Name drop-down list and the console indicates that custom certificate upload is not supported, upload the certificate in the SSL Certificates Service console first, and then return to this page and select the certificate again.

    If Alibaba Cloud CDN shows Configured for the target domain name, traffic to the domain name is forwarded from OSS by CDN. In this case, the certificate must be managed in the CDN console, and certificate hosting is unavailable in the OSS console. For more information, see the CDN-accelerated domain name tab of this topic.

    CDN-accelerated domain name

    Applies to scenarios in which traffic is forwarded from a CDN-accelerated domain name to an OSS bucket.

    Important

    Before you begin, make sure that you have configured CDN acceleration and use the accelerated domain name as the access endpoint, and that you hold a valid SSL certificate that matches the domain name. You can obtain the certificate by purchasing a new certificate, applying for a free certificate, or uploading a third-party certificate. You can also directly enter the content and private key of a third-party certificate in the subsequent configuration steps.

    1. Go to the CDN console, click the target accelerated domain name, and then click HTTPS. Next to SSL Certificate, click Modify.

    2. Select HTTPS Secure Acceleration, read the billing notice, and click OK.

    3. In the Certificate Source section, select an SSL certificate or enter third-party certificate information.

      • SSL Certificates Service: Select a certificate from the drop-down list to the right of Certificate Name.

      • Custom Certificate (Certificate+Private Key): Follow the on-screen instructions to enter Certificate Name, Certificate (Public Key), and Private Key.

    4. Click OK to finish configuring the HTTPS certificate.

    Note

    If you cannot select the target certificate, go to the SSL Certificates Service console and make sure that the certificate meets the following conditions:

    • The certificate is issued and within its validity period.

    • The domain names that the certificate is bound to include the domain name that you want to configure.

    Step 2: Verify HTTPS access

    After the configuration is complete, wait for it to take effect (the CDN HTTPS configuration takes about 1 minute), and then verify HTTPS access in a browser:

    OSS custom domain name

    1. Go to the Buckets page and click the name of the target bucket.

    2. Click the file name of the target object or View Details in the Actions column. For Domain Name, select Custom Domain, then select the bound custom domain name from the drop-down list and click Copy Object URL.

    CDN-accelerated domain name

    Construct an access URL by using the CDN-accelerated domain name, for example, https://example.com/example.jpg , where example.com is the CDN-accelerated domain name.

    Access the URL in a browser. If a secure lock icon is displayed in the address bar, the connection is encrypted.

    Enforce HTTPS access

    In production environments, we recommend that you enforce HTTPS for all clients to prevent data from being stolen or tampered with during transmission. Choose the corresponding configuration method based on the domain name type.

    OSS custom domain name

    Go to the Buckets page, click the target bucket, and then in the left-side navigation pane, click Permission Control > Bucket Policy. Choose Add by Syntax to add the following Bucket Policy that denies all HTTP requests.

    Note

    Replace <bucket-name> in the example with the actual bucket name. If a policy already exists, add the Statement to the existing policy.

    {
    "Version": "1",
    "Statement": [{
        "Effect": "Deny",
        "Action": ["oss:*"],
        "Principal": ["*"],
        "Resource": [
            "acs:oss:*:*:<bucket-name>",
            "acs:oss:*:*:<bucket-name>/*"
        ],
        "Condition": {
            "Bool": {
                "acs:SecureTransport": ["false"]
            }
        }
    }]
}

    CDN-accelerated domain name

    Use either of the following methods to enforce HTTPS access for clients:

    • Configure forced redirection:

      1. Go to the CDN console, click the target accelerated domain name, and then click HTTPS.

      2. Next to HTTP/S Redirect, click Modify, select HTTP - > HTTPS, and then click OK.

        After the configuration is complete, CDN forcibly redirects HTTP requests to HTTPS requests by using 301 redirects. For more information, see Configure HTTP/S redirection.

    • Enable HSTS:

      1. Go to the CDN console, click the target accelerated domain name, and then click HTTPS.

      2. Next to HSTS, click Modify and turn on HSTS, and then click OK.

        After the configuration is complete, the browser automatically converts HTTP requests to HTTPS requests. For more information, see Configure HSTS.

    Certificate lifecycle management

    View the certificate expiration time

    OSS custom domain name

    1. Go to the Buckets page, click the target bucket, and then in the left-side navigation pane, click Bucket Settings > Domain Names.

    2. In the SSL Certificate column of the target domain name, click Certificate Details and view the issue time and expiration time of the certificate in the certificate details dialog box.

    The SSL Certificate column also shows the hosting status of the certificate, such as Hosting, Hosting (Expiring Soon), and Hosting (Expired). You can use the status to determine whether you need to update the certificate.

    CDN-accelerated domain name

    Go to the CDN console and click Certificate Center in the left-side navigation pane to view the certificate expiration time.

    Update a certificate

    The procedure for updating a certificate is the same as that for the initial configuration. Choose the corresponding path based on the domain name type and update method.

    Console

    • OSS custom domain name: Go to the Buckets page. In the Bucket Settings > Domain Names of the target bucket, click Upload Certificate in the Actions column of the target domain name, select a new certificate, and then click Upload and Overwrite. The new certificate overwrites the original certificate.

    • CDN-accelerated domain name: Go to the CDN console and select or upload a new certificate in HTTPS of the target accelerated domain name.

    CLI and API

    • OSS custom domain name: Bind a certificate to a custom domain name by using ossutil. For more information, see put-cname. Updating a certificate does not affect the CNAME record or bucket that are already bound, and you do not need to rebuild or recreate them.

    • CDN-accelerated domain name: Set a CDN domain name certificate by using Alibaba Cloud CLI. For more information, see Manage Alibaba Cloud CDN with the CLI and SetCdnDomainSSLCertificate.

    Automatic renewal

    SSL certificates have a fixed validity period, and access is interrupted after a certificate expires. We recommend that you update certificates 30 days in advance.

    • Alibaba Cloud SSL certificates: Purchase and enable automatic certificate hosting supports automatic renewal to reduce manual intervention.

    • Third-party certificates: Establish a regular update process and assign owners to ensure timely renewal.

    Disable HTTPS access

    If you no longer need encrypted HTTPS access, you can disable it by using the following methods.

    OSS custom domain name

    1. Go to the Buckets page, click the target bucket, and then in the left-side navigation pane, click Bucket Settings > Domain Names.

    2. In the SSL Certificate column of the target domain name, click the delete icon next to Certificate Details, and then click OK. After the certificate is deleted, the domain name cannot be accessed over HTTPS. Make sure that you have disabled enforced HTTPS access and completed the related service switchover.

    CDN-accelerated domain name

    Important

    To avoid access interruptions, before you disable HTTPS, you must restore the forced redirection type to the default value and disable HSTS.

    1. Go to the CDN console, click the target accelerated domain name, and then click HTTPS. Next to SSL Certificate, click Modify.

    2. Turn off HTTPS Secure Acceleration, and then click OK.

    Use HTTPS in production environments

    Performance optimization

    Modern browsers and CDNs generally support HTTP/2, which provides advantages such as multiplexing and header compression over HTTP/1.1. When you configure CDN, Configure HTTP/2 and Gzip compression can optimize transmission efficiency while ensuring security.

    Risk mitigation

    • Backup certificate mechanism: Prepare a backup SSL certificate in case the primary certificate becomes invalid or the CA fails. For mission-critical workloads, we recommend that you use certificates from different CAs as backups so that you can quickly switch when the primary certificate has issues.

    • HTTP fallback strategy: If a serious certificate configuration problem occurs and cannot be fixed quickly, establish a standard emergency procedure to temporarily allow HTTP access while strengthening monitoring to ensure timely recovery.

    Billing

    After you enable HTTPS in CDN, you are charged separately based on the number of static HTTPS requests generated. For more information, see Static HTTPS requests.

    FAQ

    Why does my browser still report "Not secure" or a certificate error after I configure an SSL certificate?

    If a security warning still appears after the configuration is complete, troubleshoot the issue by using the following methods:

    • Check the configuration location: Confirm whether CDN acceleration is enabled for the access domain name. If CDN acceleration is enabled, you must configure the HTTPS certificate in the CDN console. Certificate hosting configured in the OSS console does not take effect.

    • Clear the browser cache: The browser may cache the previous certificate state. Clear the cache and access the URL again.

    • Wait for the configuration to take effect: The CDN HTTPS configuration or OSS certificate hosting takes a period of time to take effect.

    • Check certificate chain integrity: A certificate issued by an intermediate CA must be uploaded together with the intermediate certificate, concatenated with the server certificate into a complete certificate chain. Certificate authorities usually provide concatenation instructions. Check the relevant documentation carefully.

    How do I handle certificate errors when I access OSS over HTTPS?

    Use the corresponding method based on the type of certificate error:

    • Certificate not configured: The browser reports NET::ERR_SSL_PROTOCOL_ERROR . The certificate may not be configured, or it may be configured in the wrong place (for example, CDN acceleration is enabled but the certificate is configured in the OSS console). Configure it again as described in Enable HTTPS access of this topic.

    • Certificate expired: The browser reports NET::ERR_CERT_DATE_INVALID . Reconfigure the certificate as described in Update a certificate of this topic.

    • Certificate mismatch: The browser reports NET::ERR_CERT_COMMON_NAME_INVALID . The access domain name is not included in the domain names that the certificate is bound to (for example, you access cdn.example.com but the certificate is bound to oss.example.com ). Configure the correct certificate for the domain name.

    Why can't I find my target certificate in the drop-down list when I select a certificate?

    • The certificate does not match the domain name: The system lists only certificates that match the current domain name. For example, when you configure a certificate for oss.example.com , you cannot select a certificate that was issued to cdn.example.com .

    • The certificate is not in the current account: Upload the certificate on the SSL Certificate Management page.

    • The wildcard certificate level does not match: A wildcard certificate applies only to domain names at the same level. For example, *.example.com matches www.example.com and oss.example.com , but does not match cdn.oss.example.com .

    Why does the CDN console report an invalid certificate format when I configure an HTTPS certificate, and how do I convert the format?

    The CDN HTTPS configuration supports only PEM certificates. If your certificate is not in PEM format, convert the format as described in Certificate format before you upload the certificate.

    How do I troubleshoot custom domain name upload failures when I upload objects in the OSS console?

    When you upload an object in the OSS console, the upload page provides two options: Internet Domain Name and Custom Domain, and Internet Domain Name is selected by default. The two options affect only the access domain name used for the upload. The objects uploaded to the bucket are the same, and there is no functional difference.

    • Internet Domain Name: The default access domain name of the bucket (formatted as <bucket-name>.oss-<region-id>.aliyuncs.com ). Alibaba Cloud manages SSL certificates for this domain name in a unified manner, and HTTPS is supported natively, so you can upload objects without additional configuration.

    • Custom Domain: When you switch to Custom Domain, the console displays the following message: "When you access data by using a custom domain name, make sure that the CNAME record and certificate of the bound custom domain name are correctly configured. Otherwise, access may fail." This message points to the root cause of the failure: custom domain names require manual configuration. Otherwise, uploads fail. Troubleshoot the issue by using the following steps:

      1. Confirm that the custom domain name is bound to the current bucket and that the CNAME record is correctly resolved to the Internet access domain name of the bucket.

      2. Confirm that a valid matching SSL certificate is configured for the custom domain name. If CDN acceleration is disabled, go to Bucket Settings > Domain Names, click Upload Certificate in the Actions column of the target custom domain name, and then select a certificate. If CDN acceleration is enabled, you must configure the certificate in the CDN console. Certificate hosting configured in the OSS console does not take effect.

      3. If the certificate-related errors persist, troubleshoot the issue as described in the certificate error questions earlier in this section (the certificate is not configured, has expired, or does not match the domain name).

      4. To quickly restore uploads, switch back to the default Internet Domain Name on the upload page. The upload result is the same as that of the custom domain name.

    Related topics