Download an SSL certificate and its private key to your computer - Certificate Management Service

Certificate Management Service packages SSL certificates in server-ready formats for NGINX, Apache HTTPD, Apache Tomcat, Spring Boot, and Internet Information Services (IIS). Download the package for your server type and install it directly—no format conversion needed.

Important

For certificates purchased through SSL Certificate Management V2.0, download from the SSL Certificate Management V2.0 page. For certificates purchased through non-V2.0 channels, download from the SSL Certificate Management (V1.0 no longer available for new purchases) page.

Prerequisites

You have issued a certificate through the Certificate Management Service console. For details, see Purchase an official certificate.

Notes

For data security, third-party certificates uploaded to Certificate Management Service for centralized management cannot be downloaded.
You can download an SSL certificate only when its status is Issued, Pending Expiration, or Expired. Certificates in other states cannot be downloaded.

Procedure

Log in to the Certificate Management Service console.
For certificates purchased through V2.0, choose Certificate Management > SSL Certificate Management V2.0 in the left-side navigation pane. For certificates purchased through V1.0, choose Certificate Management > SSL Certificate Management (V1.0 no longer available for new purchases).
On the Commercial Certificates tab, select the certificate to download and click Download below the certificate list.

In the dialog box that appears, select the certificate format that matches your server type, download the certificate package, and decompress it.

If the certificate format that matches your server type is not listed, download the PEM format and convert it using a certificate conversion tool. For details, see Convert the format of a certificate.

Note

For information about how to check the server type, see Query the server type.
The downloaded certificate file typically includes an intermediate certificate. If you encounter an untrusted intermediate certificate issue when installing the SSL certificate, contact your account manager.
If you used a certificate signing request (CSR) file manually generated by using tools such as OpenSSL or Keytool during the certificate application process, the private key is managed locally. The downloaded certificate package does not include the private key file.

Server types and certificate formats

When you download a certificate, the dialog box provides the following certificate formats:

Certificate type	Server type	Certificate format	Files in the package
SSL certificate	NGINX	PEM A Base64-encoded universal certificate format that can be viewed as plain text. Applies to most servers or applications such as NGINX.	domain name.pem: the certificate file. domain name.key: the private key file of the certificate.
	Tomcat	PFX (also known as PKCS#12) A binary format that contains both the public key and private key. Applies to servers such as Tomcat, IIS, and Exchange.	domain name.pfx: the certificate file in PFX format. pfx-password.txt: the password that protects the certificate. Note When you submit the certificate request, if you did not set CSR Generation Method to System Generated, the downloaded certificate package does not include the TXT password file.
	Apache	CRT A binary format that contains the certificate and related metadata (issuer information, validity period, subject, and more), but not the private key. Applies to Apache servers.	domain name_public.crt: the certificate file. domain name_chain.crt: the certificate chain file. domain name.key: the private key file of the certificate.
	IIS	PFX (also known as PKCS#12) A binary format that contains both the public key and private key. Applies to servers such as Tomcat, IIS, and Exchange.	domain name.pfx: the certificate file. pfx-password.txt: the password that protects the certificate.
	JKS	JKS A keystore format exclusive to the Java platform. Applies to Java-based web servers or applications such as Tomcat and Jetty.	The decompressed package contains the following files: domain name.jks: the certificate file. jks-password.txt: the password that protects the certificate.
	Other	PEM A general-purpose certificate format based on Base64 encoding that can be viewed as plain text. If the format you need is not available in the console, select this format and convert it manually after download.	Certificate files in PEM format: domain name.pem: the certificate file in PEM format. domain name.key: the private key file of the certificate.
	Download Root Certificate	A root certificate is typically in CRT or CER format. It applies to non-PC browser scenarios such as app services and IoT terminals that do not have pre-installed root certificates. You need to download and install the root certificate for the corresponding SSL certificate brand. For more information, see View document.	N/A
SM2 certificate	N/A	PEM	PEM SM2 certificates use the PEM format regardless of the server type. After decompression, the package contains the following files: Signing certificate and private key: domain name_sm2_sign.pem and domain name_sm2_sign.key. Encryption certificate and private key: domain name_sm2_enc.pem and domain name_sm2_enc.key.

What to do next

After you download the SSL certificate to your computer, manually configure it on your web application server. For more information, see Manually Deploy a Certificate.