Certificate Management Service:Installation overview

Installation scenarios

Download a certificate to your computer

Different types of servers support different formats of certificates. To facilitate certificate installation, Certificate Management Service provides certificate packages that are suitable for servers such as NGINX, Spring Boot, Apache Tomcat, Apache HTTPD, and Internet Information Services (IIS) servers. You can download and use the packages without the need to convert the formats of certificates. If you do not know the type of your server, you must query the type of the server. For more information, see How do I view the type of a server?

1. Log on to the Certificate Management Service console.
2. In the left-side navigation pane, click SSL Certificates.
3. On the Manage Certificates tab of the SSL Certificates page, find the certificate that you want to download and click Download in the Actions column.
   Note The Download button appears in the Actions column only when the certificate is in the Issued, Pending Expiration, or Expired state. If the certificate is in a different state, the Download button does not appear.
4. In the Download Certificate panel, find the certificate and click Download in the Actions column.
   Certificate Management Service automatically converts the certificate into different formats that are suitable for different types of servers and compresses the certificate into packages. After you download the certificate package, you can extract the certificate files from the package. The following table describes the files that can be extracted from certificates other than SM2 certificates.

   Note

   In most cases, SM2 certificates are in the PEM format. A downloaded package of SM2 certificates contains the following files:

   • Signing certificate: server_sign.pem and server_sign.key.
   • Encryption certificate: server_enc.pem and server_enc.key.

   If the format of the downloaded certificate does not suit your server, you can use a tool to convert the certificate to the required format.

   If your servers are accessed by using client browsers, you do not need to install root certificates because the root certificates are built into the client browsers. If your servers are accessed by using clients such as Java clients, you must install root certificates and intermediate certificates on the clients because no root certificates or intermediate certificates are built into the clients. For more information, see Download a root certificate and an intermediate certificate.

   Server type	Certificate file description
   Tomcat	In most cases, you must install a PFX certificate or a JKS certificate on a Tomcat server. To download a JKS certificate, find the certificate package for JKS and click Download in the Actions column. A PFX certificate package contains the following files: domain name.pfx: a certificate authority (CA) certificate file in the PFX format pfx-password.txt: a password file Note If you do not set CSR Generation to Automatic when you apply for a certificate, the certificate package that you download does not include the TXT password file.
   Apache	In most cases, you must install a CRT certificate on an Apache server. A CRT certificate package contains the following files: domain name_public.crt: a CA certificate file domain name_chain.crt: a certificate chain file domain name.key: a private key file
   NGINX	In most cases, you must install a PEM certificate on an NGINX server. A PEM certificate package contains the following files: domain name.pem: a CA certificate file domain name.key: a private key file
   IIS	In most cases, you must install a PFX certificate on an IIS server. A PFX certificate package contains the following files: domain name.pfx: a CA certificate file pfx-password.txt: a password file
   JKS	In most cases, you must install a JKS certificate on a JKS server. A JKS certificate package contains the following files: domain name.jks: a CA certificate file jks-password.txt: a password file
   Others	You must install a PEM certificate on a server of other types. A PEM certificate package contains the following files: domain name.pem: a CA certificate file in the PEM format domain name.key: a private key file

Install the certificate on your server

After you download the certificate to your computer, you must upload the certificate to your server and modify the server settings for the certificate to take effect. For more information about how to download a certificate, see Download a certificate to your computer.