Configure a custom domain name and an SSL certificate - Drive and Photo Service

Usage notes

To raise the daily limit for creating and accessing shares above 500, or to remove the restriction on downloading APK and IPA files from external shares, you must configure both an enterprise domain name and a data access domain name.
If you use BasicUI for public services or internal use, and it receives more than 1,000 daily visits, you must configure a custom domain name.
To use a custom API domain name or logon authentication domain name, contact us to enable the feature.

Prerequisites

A PDS Developer Edition domain is created.
Only a super administrator or drive administrator can enable this feature.
You have enabled BasicUI.
You have registered a domain name.
If your service is deployed in the Chinese mainland region, ensure that you have completed ICP filing for the domain name.
You have an SSL certificate. If you do not have one, you can purchase an SSL certificate from Certificate Management Service. For more information, see Purchase a commercial certificate and Apply for a certificate.

Important

If you completed the ICP filing through a provider other than Alibaba Cloud, the system might fail to retrieve the filing status. This can cause domain name binding or access to fail.

Use cases

Enterprise domain name

An enterprise domain name serves as the access address for your website. It is designed to be easy to remember and reflects your corporate identity.

Data access domain name

A data access domain name is used to access file data or for transcoding and playback.

File transfer

This domain name is used for file transfers within the drive and through external links, such as file uploads and downloads.

Value-added service

This domain name is used for value-added services such as audio and video transcoding, online video playback, and batch downloads.

API domain name

An API domain name is used for API requests. This provides your enterprise with simpler and more intuitive URLs.

Logon authentication domain name

A logon authentication domain name is used for user logon and authentication.

Procedure

Step 1: Configure DNS

Obtain the DNS record value.

Important
This document describes how to obtain record values for multiple domain name types. Follow the steps that apply to your scenario.
Enterprise domain name
1. Log on to BasicUI and go to the admin console.
2. In the left-side navigation pane, choose Enterprise Settings > Standard Customization.
3. Find the Default Domain under the Enterprise Domain Name section and copy its value.
  
  Record value: example.apps.aliyunpds.com.
Data access domain name
1. Log on to BasicUI and go to the admin console.
2. In the left-side navigation pane, choose Enterprise Settings > Standard Customization.
3. Find the Default Domain under the Data Access section and copy its value.
  Important
  
  For each service type, you must configure two CNAME records: one for the custom domain name and one to verify DNS domain ownership. For more information, see Example: Map a DNS record for a data access domain name.
  
  www.example.com is an example of a custom data access domain name.
  
  example2.data.aliyunpds.com is an example of a Default Domain.
  1. For the custom data access domain name:
    
    Host record: www.example.com.
    
    Record value: example2.data.aliyunpds.com.
  2. For DNS domain ownership verification:
    
    Host record: _dnsauth.www.example.com.
    
    Record value: _dnsauth.www.example.com.example2.data.aliyunpds.com.
  3. On the Standard Customization page, get the Default Domain for File transfer or Value-added service as needed.
API domain name
1. Log on to BasicUI and go to the admin console.
2. In the left-side navigation pane, choose Enterprise Settings > Standard Customization.
3. Find the Default Domain under the API Domain Name section and copy its value.
  
  Record value: example.api.aliyunpds.com
Logon authentication domain name
1. Log on to BasicUI and go to the admin console.
2. In the left-side navigation pane, choose Enterprise Settings > Standard Customization.
3. Find the Default Domain under the Logon Authentication Domain Name section and copy its value.
  
  Record value: example.auth.aliyunpds.com

Follow the appropriate steps for your domain name provider to point your domain name to the PDS service.

Alibaba Cloud domain

Log on to the Alibaba Cloud DNS console.
In the list of authoritative domain names, find the target domain name and click DNS Settings in the right-side column.
Click Add DNS Record and configure the following parameters.

Parameter	Description	Example value
Record type	Select CNAME as the record type.	CNAME
Host record	Enter the subdomain prefix that you want to use to access PDS.	www
DNS request source	The resolution line. We recommend selecting Default to allow the system to automatically choose the best route.	Default
Record value	Enter the default domain name for your enterprise.	example.apps.aliyunpds.com
TTL	The time-to-live (TTL) for the DNS record. The minimum value is 1 second. Note There may be a delay before the TTL change takes effect.	10 minutes

Other domain providers

On your domain provider's DNS management platform, add a CNAME record with the following information.

Parameter	Description	Example value
Record type	Select CNAME as the record type.	CNAME
Host record	Enter the subdomain prefix that you want to use to access PDS.	www
DNS request source	The resolution line. We recommend selecting Default to allow the system to automatically choose the best route.	Default
Record value	Enter the default domain name for your enterprise.	example.apps.aliyunpds.com
TTL	The time-to-live (TTL) for the DNS record. The minimum value is 1 second. Note There may be a delay before the TTL change takes effect.	10 minutes

Verify that the DNS resolution has taken effect.

After you bind the custom domain name, you can use the Alibaba Cloud Network Probing Tool to check the CNAME resolution result.

The CNAME record for your custom domain name is active if the DNS resolution result points to the public access domain name of Drive and Photo Service (PDS).

Select the DNS tab, enter your custom domain name, and click Detect Now. In the Resolution Result column of the detection results, verify that the returned CNAME record points to the public access domain name of Drive and Photo Service (PDS).

Step 2: Configure custom domain name

Important

Before configuring the custom domain name, ensure that DNS resolution has taken effect.
Before you configure the custom domain name, download an SSL certificate of the Other service type. This provides two files: example.key and example.pem.

Log on to BasicUI and go to the admin console.
In the left-side navigation pane, choose Enterprise Settings > Standard Customization.

Click Configure Domain Name.

Parameter	Description	Example value
Custom domain name	The domain name for which you configured DNS records.	www.example.com
Certificate name	The name of the certificate.	cert_xxxxx
Certificate content	The full content of the example.pem file of the SSL certificate. Note If the certificate is issued by an intermediate certificate authority, the certificate content must be a combination of your downloaded certificate and the intermediate certificate.	-----BEGIN CERTIFICATE----- example -----END CERTIFICATE-----
Certificate private key	The full content of the example.key file of the SSL certificate.	-----BEGIN RSA PRIVATE KEY----- example -----END RSA PRIVATE KEY-----

Click Set Now to complete the Custom Domain Names configuration.

Appendix

Data access DNS example

Note

The domain names used in this example are for illustrative purposes only. Replace them with your actual domain names during configuration.

For example, your domain name is aliyundoc.com.

Expected custom File Transfer domain name: data.aliyundoc.com.
File Transfer default domain name: 5b3ede2bf7464bcd8a76eed52975****.data.aliyunpds.com.

Example of a custom data access domain name.

Configure DNS:

Parameter	Example value
Record type	CNAME
Host record	data
DNS request source	Default
Record value	`5b3ede2bf7464bcd8a76eed52975****.data.aliyunpds.com`
TTL	10 minutes

Resolution example:

Set Record Type to CNAME - Map a domain name to another domain name, host record to data, and DNS request source to Default. For the record value, use the CNAME address assigned by PDS, which has the format <hash_string>.data.aliyunpds.com. Set TTL to the recommended 10 minutes.

Example of DNS domain ownership verification.

Configure DNS:

Parameter	Example value
Record type	CNAME
Host record	_dnsauth.data
DNS request source	Default
Record value	`_dnsauth.data.aliyundoc.com.5b3ede2bf7464bcd8a76eed52975****.data.aliyunpds.com`
TTL	10 minutes

Resolution example:

Add a CNAME record: Set Record Type to CNAME, host record to _dnsauth.data, and DNS request source to Default. For the record value, use the CNAME value provided for DNS verification, such as _dnsauth.data.aliyundoc.com.xxxx. Set TTL to the recommended 10 minutes.

FAQ

Default domain availability

Yes, you can.

Unmapping a custom domain

To unmap a custom domain name, follow these steps:

Unmap the custom domain name.
1. Log on to the admin console of Drive and Photo Service (PDS) Developer Edition.
2. In the left-side navigation pane, choose Enterprise Settings > Standard Customization.
3. On the Standard Customization page, find the domain name you want to unmap and click Delete Configuration.
Delete the DNS record.

After you unmap the custom domain name, you must manually delete the CNAME record you configured. For more information, see Delete a DNS record.

Certificate addition error

If you encounter this error while configuring a domain name, check whether your certificate is correctly configured or has expired.

Certificate Content: The certificate content must be the full content of the file that starts with "-----BEGIN CERTIFICATE-----".

Certificate Private Key: The private key must be the full content of the file that starts with "-----BEGIN RSA PRIVATE KEY-----".

Certificate private key: The entire configuration beginning with -----BEGIN RSA PRIVATE KEY-----.

Domain propagation delay

DNS changes may take some time to propagate. Wait for about 10 minutes and try again.