Certificate Management Service:Server deployment: Deploy an SSL certificate to a cloud or local server

How server deployment works

Manually downloading certificates and replacing certificate files on servers requires you to log on to each server. Any omission may affect your online HTTPS services. Server deployment automates this step.

After you create a deployment task in the console and specify the certificate and domain name to deploy, the system generates an External Account Binding (EAB) credential for the server. After you use this credential to complete the access configuration on the server once, the certificate specified in the console is automatically deployed to that server. You no longer need to transfer certificate files manually.

Server deployment supports the following server types:

• Alibaba Cloud ECS: Select the target ECS instance directly from the instance list. You can use Remote Execution to have the console issue the installation command without logging on to the server.

• Multi-Cloud Server: For a server from another cloud provider or a self-managed local server, log on to the server and run the installation command manually.

Limits

Prerequisites

• The certificate instance is associated with a Professional Edition or Ultimate Edition automation service. For information about the association rules, see Certificate automation service billing.

• The target server can access the Internet and has a web service, such as NGINX or Apache, installed.

Step 1: Create a server deployment task

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Deployment Management > Server Deployment.

3. Click Deploy Certificate.

4. In the Deploy Certificate panel, configure the parameters described in the following table, and then click OK.

   Parameter	Description
   Resource Type	Select the type of the server to which you want to deploy the certificate. Alibaba Cloud ECS: Select the target instance from the Alibaba Cloud ECS instance list. Multi-Cloud Server: Select this option for a server from another cloud provider or a local server.
   Select Certificate	Select Existing Certificate to deploy an existing certificate instance in your account.
   Certificate Instance	Select the certificate instance to use for this deployment from the drop-down list.
   Domain Names	Enter the domain name for this deployment. You can enter only one domain name: a single domain name such as www.example.com, or a wildcard domain name such as *.example.com.
   ECS Region	Configure this parameter when Resource Type is set to Alibaba Cloud ECS. Select the region in which the target ECS instance resides.
   ECS Instance	Configure this parameter when Resource Type is set to Alibaba Cloud ECS. Select the target ECS instance. The ECS instance name is automatically used as the server name.
   Server Name	Configure this parameter when Resource Type is set to Multi-Cloud Server. Specify an easy-to-identify name for the server. You can use this name to locate the server in the server deployment list.

5. After the task is created, a record is added to the server deployment list. Status/Connection Time is displayed as not connected, which indicates that the system is waiting for you to complete the deployment configuration on the server.

Step 2: Complete the deployment configuration on the server

Find the target server in the server deployment list. In the Actions column, click Installation Guide. The panel displays the Basic Information of the server, including the server name, instance ID, resource type, certificate instance ID, certificate ID, domain name, certificate name, and validity period. The panel also displays the EAB Credential (Kid and HmacKey) and the installation command.

Choose one of the following methods. If Resource Type is set to Alibaba Cloud ECS and the instance meets the requirements for remote execution, use Method 1. For a Multi-Cloud Server, or for an ECS instance that does not meet those requirements, use Method 2.

The commands in Installation Steps complete the access configuration on the server. In Method 1, the console runs the installation command on the ECS instance automatically. In Method 2, you run the commands on the server yourself. Check the following parameters in these commands:

• In the Install command, set the email parameter to your email address.

• In the Add command, set the --eab-kid and --eab-hmac-key parameters to the EAB credential displayed for the current server in the panel. Do not reuse the credential of another server.

• In the Install Certificate command, the --key-file and --fullchain-file parameters are prefilled with the default certificate installation paths of NGINX and Apache. You do not need to change them unless you modified the default paths when you installed NGINX or Apache. In that case, set the parameters to the actual paths of the certificate private key and the certificate chain file on the server. Otherwise, the updated certificate is not loaded.

Step 3: Verify the deployment result

On the Server Deployment page, verify that the deployment takes effect:

• In the server deployment list, check that the Status/Connection Time column of the target server displays the connected state and the connection time.

• Access the deployed domain name over HTTPS and verify that the certificate information displayed in the browser matches the deployed certificate. If the domain name cannot be accessed as expected, see How do I fix certificate errors shown in my browser? for troubleshooting.

The Server Deployment page also provides the following deployment details:

• The Attached Certificate column displays the certificate instance ID, service version, certificate name, domain name, and certificate ID. The Certificate Status column displays the certificate status and validity period.

• Server Deployment Overview displays the numbers of Deployed Nodes, Undeployed Nodes, and Deployed Certificates. Click View to go to the corresponding server list.

• If you have a large number of servers, filter them by using the All, Alibaba Cloud ECS, or Multi-Cloud Server tab, or search by server name, instance ID, or KID.

Manage deployed servers

In the server deployment list, find the target server. In the Actions column, click Installation Guide. For other operations, click More. The following operations are available: