Automatic certificate hosting renews and deploys certificates during the certificate subscription period. This topic describes how to purchase and use automatic certificate hosting.
Limits
Uploaded Certificates(certificates that were not purchased from Alibaba Cloud) do not support automatic certificate hosting. To use this feature, you can Purchase a commercial certificate.
When an OV or EV certificate is renewed, the certificate authority (CA) cannot automatically complete the review. You must complete the review as required by the CA. The CA can automatically review a DV certificate renewal if the domain uses Alibaba Cloud DNS and the domain and certificate belong to the same Alibaba Cloud account.
Automatic certificate hosting applies only when a certificate is renewed during its subscription period. You must complete the initial issuance and deployment after you purchase the certificate.
Step 1: Purchase automatic certificate hosting
If you select the Professional Edition or Ultimate managed service when you purchase a certificate, automatic certificate hosting is included with the certificate instance. For information about how to purchase a certificate, see Purchase a commercial certificate.
If you did not select the Professional Edition or Ultimate managed service, upgrade the service:
Log on to the Certificate Management Service console.
In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0. Then, click the Commercial Certificates tab.
Find the target certificate and click Service Upgrade in the Actions column. Upgrade to the Professional Edition or Ultimate managed service.
Step 2: Enable automatic certificate hosting
Perform the following steps:
Log on to the Certificate Management Service console.
In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0. Then, click the Commercial Certificates tab.
Find the target certificate and click Auto-managed Certificate in the Actions column.
Optional: Configure domain verification exemption so that domain ownership is automatically verified when the DV certificate is renewed. For more information, see Add and pre-authorize a domain.
Step 3: Configure the automatic certificate hosting policy
By default, the system starts the renewal 30 days before the certificate expires. After the certificate is renewed, the system immediately deploys it at 12:00 noon. To change these settings, perform the following steps:
Log on to the Certificate Management Service console.
In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0. Then, click the Commercial Certificates tab.
Find the target certificate and click Details in the Actions column.
Click the Managed tab.
To the right of Hosting Policy, click Edit Managed Policy. Configure the following parameters:
Parameter
Description
Certificate Issuance Time (Days Before Expiration)
Specify how many days before the certificate expires the system starts the renewal. You can specify 15 to 30 days. The default value is 30 days.
Cloud Service Deployment Time
Specify when to deploy the certificate after it is issued. The following options are available:
Execute immediately after issuance: Deploy the certificate immediately after it is issued. This is the default option.
Execute on a specified date after issuance: Deploy the certificate 1 to 7 days after it is issued.
Execute Manually: Do not automatically deploy the certificate after it is issued. You must deploy it manually.
Deployment Execution Time
Specify when the automatic deployment task runs. We recommend that you select an off-peak period. The default time is 12:00 noon.
Click OK. The policy takes effect immediately.
Step 4: View the automatic certificate hosting status
After you enable automatic certificate hosting, perform the following steps to view the hosting status:
Log on to the Certificate Management Service console.
In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0.
Click the Commercial Certificates tab.
Find the target certificate and check the Validity Period column. If the Auto-Managed tag is displayed, automatic certificate hosting is enabled.
FAQ
Does automatic certificate hosting enable auto-renewal?
No. Automatic certificate hosting and auto-renewal are different features. Automatic certificate hosting applies for a new certificate and deploys it before the hosted certificate expires if the required conditions are met. Auto-renewal automatically purchases the certificate service to extend the service expiration time if your account balance is sufficient. To use auto-renewal, enable it when you purchase or renew the certificate.