Certificate Management Service:Manage certificates in a certificate application repository

Entry point

1. Log in to the Certificate Management Service console.

2. In the navigation pane on the left, choose Certificate and Domain Application Services > Certificate Application Repository.

3. On the Certificate Application Repository page, click the target certificate application repository.

4. On the Certificate Management page, manage the certificates in the certificate application repository.

Alibaba Cloud private certificate repository (request a certificate)

1. On the Certificate Management page, click Apply for Certificate.

2. In the Apply for Certificate panel, configure the private certificate parameters as described in the following table, and then click Confirm.

   Configuration item	Description
   Certificate Type	Server Certificate: Install on your application server for server-side identity authentication. Client Certificate: Install on clients for client-side identity authentication.
   Common Name (CN)	The Common Name of the certificate subject.
   Validity Period	The validity period of the private certificate. The validity period depends on the service duration of your subordinate CA: If the service duration is less than one year, the certificate validity period cannot exceed the purchased PCA service duration. For example, if you purchase a one-month PCA service, the maximum certificate validity period is 31 days. To extend the validity period, renew your PCA service. For renewal steps, see Renewal policy. If the service duration is one year or longer, the supported certificate validity period ranges from 1 to 100 years.
   SAN	The SAN extension property of the private certificate, used to apply the certificate to multiple subjects. If the certificate needs to apply to multiple subjects, add other subject information using the SAN extension. For server certificates, enter domain names or IP addresses. For client certificates, enter email addresses or URIs. You can add up to 10 SAN extensions. Note SAN (Subject Alternative Name) is an extension field defined in the X.509 standard that allows a single certificate to support multiple domain names. A URI (Uniform Resource Identifier) identifies the Alibaba Cloud resource associated with the certificate, such as the Elastic Compute Service (ECS) instance where the private certificate is deployed.
   More	To add certificate name, company, or department information to the certificate, click More.
   Include CRL Address	Enabled by default. For more information about CRL, see CRL service.

Alibaba Cloud compliance certificate repository (request a certificate)

1. On the Certificate Management page, click Apply for Certificate.

2. In the Apply for Certificate panel, configure the compliance certificate parameters as described in the following table, and then click Confirm.

   Parameter	Description
   Personal Name	The name of the certificate owner.
   More	To add certificate name, company, and department information to the certificate, click More to configure.

Upload certificate repository (upload a certificate)

1. On the Certificate Management page, click Upload Certificates.

2. In the CA Information panel, configure the certificate parameters, and then click Confirm and Enable.

   Parameter	Description
   Package Name	Set the name of the certificate to upload. The name can contain letters, periods (.), digits, underscores (_), and hyphens (-).
   Certificate File	Enter the PEM-encoded certificate file content. Open the PEM or CRT certificate file with a text editor, copy the content, and paste it into the text box. You can also click Upload and Parse File below the text box to upload a local certificate file.
   Certificate Key	Enter the PEM-encoded certificate private key content. The following methods are supported: Manual entry: Open the KEY private key file with a text editor, copy the content, and paste it into the text box. Upload a local private key file: Click Upload and Parse File below the text box to upload a local private key file. Select an existing CSR (Certificate Signing Request): You can select a CSR that was created or uploaded through the Digital Certificate Management Service console. The system automatically matches the CSR with the corresponding certificate file. For more information, see Create or upload a CSR. Note If a certificate-private key mismatch error occurs after upload, the private key file may contain RSA characters. You can run the openssl rsa -in <original_private_key_file> -out <new_private_key_file> command to convert the file and re-upload it.

Upload CA certificate repository (upload a certificate)

1. On the Certificate Management page, click Upload Certificates.

2. In the CA Information panel, configure the certificate parameters, and then click Confirm and Enable.

   Parameter	Description
   Package Name	Set the name of the CA file to upload. The name can contain letters, periods (.), digits, underscores (_), and hyphens (-).
   CA Certificates	Enter the CA certificate file content that includes the complete certificate chain (PEM-encoded). Open the PEM or CRT CA file with a text editor, copy the content, and paste it into the text box. You can also click Upload Business License Photo below the text box to upload a local CA file. Note If the certificate chain is incomplete, after you configure an HTTPS listener in Alibaba Cloud Server Load Balancer and select this CA certificate, the load balancer cannot establish an encrypted connection with the client. For information about HTTPS listener configuration, see Add an HTTPS listener (ALB), Add a TCPSSL listener (NLB), or Add an HTTPS listener (CLB).

View, download, revoke, and delete certificates, and supplement private keys