Batch Deploy SSL Certificates to SLB, CDN & WAF - Certificate Management Service - Alibaba Cloud - Certificate Management Service

This topic describes how to create a deployment task to deploy SSL certificates to Alibaba Cloud services individually or in bulk at a scheduled time.

Before you begin

This topic does not cover Elastic Compute Service (ECS) or Simple Application Server. To deploy a certificate to an ECS instance or a Simple Application Server instance, see Update an existing certificate on an Alibaba Cloud ECS instance or a Simple Application Server instance.
You have purchased and applied for a certificate in Certificate Management Service, and its Status is Issued. To purchase and apply for a certificate, see Purchase a commercial certificate and Apply for a certificate.
The SSL certificate alias must not contain Chinese characters. The following figure shows an example.
Verify the certificate status and confirm that the certificate matches the target domain names.
Check certificate status and domain match
On the SSL Certificate Management page, find the target certificate and verify the following information:
1. Certificate Status: Make sure the status is Issued. If the status is About to Expire or Expired, you must renew the SSL certificate.
2. Bound Domains: Make sure the certificate covers all domain names you want to protect. If a domain name is not covered, users will see a security warning when they access that domain over HTTPS. To add or change domain names, see Add and replace domain names.
  Domain name matching rules
  The Bound Domains of a certificate can include multiple exact and wildcard domain names. The matching rules are as follows:
  Exact domain name: Covers only the specified domain name.
  example.com covers only example.com.
  www.example.com covers only www.example.com.
  Wildcard domain name: Covers only first-level subdomains.
  *.example.com covers first-level subdomains such as www.example.com and a.example.com.
  *.example.com does not cover the root domain example.com or multi-level subdomains such as a.b.example.com.
  Note
  To cover a multi-level subdomain, the Bound Domains field must include that specific domain name (for example, a.b.example.com) or a matching wildcard domain name (for example, *.b.example.com).

Limitations

Deploying international standard certificates

Note

If the one-click deployment feature does not support your cloud product, refer to that product's documentation to deploy the certificate.
In the table below, "Update existing certificate" refers to replacing a certificate that is already deployed on a cloud product.

Cloud product	Deployment scenarios	Scenario
Container Service for Kubernetes (ACK)	Update existing certificate	Update AlbConfig certificates and Secret certificates in ACK managed clusters and dedicated clusters Important Do not manually modify a Secret in ACK. The system automatically creates a new Secret.
Serverless App Engine - gateway routing	Update existing certificate	Configure HTTPS as the forwarding protocol for gateway routing (ALB and CLB)
Function Compute (FC)	Update existing certificate	HTTP-triggered functions
Microservices Engine - cloud-native gateway	Update existing certificate	Cloud-native gateway routing
API Gateway	Update existing certificate	Access an API over HTTPS using a domain name.
Global Accelerator (GA)	Update existing certificate	Securely accelerate access to an HTTPS domain name
Application Load Balancer (ALB) Network Load Balancer (NLB)	Update existing certificate	Use an HTTPS listener to forward requests over HTTPS (server certificate) Note To deploy a client certificate, see Configure end-to-end HTTPS to encrypt communication.
Application Load Balancer (ALB) Network Load Balancer (NLB)	Update existing certificate
Content Delivery Network (CDN)	Initial deployment, Update existing certificate	HTTPS secure acceleration
Dynamic Route for CDN (DCDN)	Initial deployment, Update existing certificate	HTTPS secure acceleration
Edge Security Acceleration (ESA)	Update existing certificate	HTTPS secure acceleration
OSS	Update existing certificate	Access OSS over HTTPS Note If you bind a domain name for CDN acceleration, you must replace the certificate in the CDN console.
Web Application Firewall (WAF)	Update existing certificate	CNAME access
Anti-DDoS Pro and Anti-DDoS Premium	Update existing certificate	Domain name access to Anti-DDoS Pro and Anti-DDoS Premium
Platform for AI (PAI)	Update existing certificate	Elastic Algorithm Service (EAS) for online model services: Use a custom domain name for a dedicated gateway

Procedure

Step 1: Purchase deployment quota

Note

Deployment quota is consumed only when you deploy certificates of the Uploaded type. If your certificate is not of the Uploaded type, skip to Step 2: Check authorizations.

If you do not have enough deployment quota, purchase a deployment package. .
Deployment quota is not consumed for certificates other than the Uploaded type, or for certificates shared between Alibaba Cloud accounts that belong to the same verified individual or enterprise. If a deployment fails, the consumed quota is refunded.

Step 2: Check authorizations

Note

If your deployment task does not involve ACK, skip to Step 3: Deploy the certificate to cloud service resources.

Before deploying a certificate to Container Service for Kubernetes (ACK), log on to the ACK console with your Alibaba Cloud account and grant the AliyunCASDefaultRole RAM role the permissions to manage the destination cluster. Otherwise, the Certificate Management Service console cannot discover the cluster namespace.

Go to the Authorization Management page in the ACK console. On the RAM Roles tab, enter AliyunCASDefaultRole and click Modify Permissions.
On the Permission Management tab, grant the O&M Engineer permission for the destination cluster.

Step 3: Deploy the certificate

Single deployment

If this is your first time using the deployment service, follow the on-screen prompts to grant the required permissions before you can create deployment tasks. For more information, see Grant permissions to access cloud resources.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Certificate Management > SSL Certificate Management.
On the SSL Certificate Management page, click the appropriate certificate tab. In the certificate list, find the certificate you want to deploy and click Deploy in the Actions column.
Certificates issued by Private CA are listed on the Uploaded Certificates tab, where you can manage them.
On the Create Task page, in the Select Resource step, select or adjust the cloud services and resources, and then click Preview and Submit.
- The system automatically matches cloud service resources that already have an SSL certificate configured. In the automatic matching dialog box, click OK. The matched resources are added to the Selected Instances: area. You can then adjust the selection as needed.
- The system automatically discovers and retrieves all resources from your cloud services. If you cannot find a target resource, check the following:
  - In the Total Resources section, check whether resource synchronization is complete. If resources are still being synchronized (shown in a grayed-out state), wait for synchronization to finish. The time required depends on the number of resources in your cloud services.
  - If you still cannot find the resource after synchronization is complete, verify that you meet the deployment prerequisites.
In the Task Preview panel, review the certificate and resource details. If everything looks correct, click Submit.
The preview page shows the number of matched certificates for each cloud service and the deployment quota to be consumed. A match count of 0 means the certificate does not match the resource, and the deployment will fail. Review your selection carefully.

Bulk deployment

If this is your first time using the deployment service, follow the on-screen prompts to grant the required permissions before you can create deployment tasks. For more information, see Grant permissions to access cloud resources.
Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Deployment and Resource Management > Deployment to Cloud Services.

On the Deployment to Cloud Services page, click Create Task and deploy the SSL certificates.

In the Configure Basic Information step, configure the task name, contact, and deployment time. Then, click Next.

Parameter	Description
Task Name	Enter a custom name for the deployment task.
Contact	Select contacts to receive deployment task notifications. You can add up to 10 contacts.
Deployment Time	Deploy Now: Deploys the certificates to cloud services immediately. Custom Time: Schedules the deployment task to run at a specific time.

In the Select Certificate step, select the SSL certificates that correspond to the cloud resources. Then, click Next.
- Certificates issued by Private CA are listed on the The ID of the certificate in Alibaba Cloud. You must upload a certificate first. tab, where you can select them.
- Each deployment task can include only certificates of a single type.
In the Select Resource step, select or adjust the cloud services and resources, and then click Preview and Submit.
Note
Bulk deployment is not supported for Server Load Balancer (SLB) listeners that are bound to multiple server certificates.
- The system automatically matches cloud service resources that already have an SSL certificate configured. In the automatic matching dialog box, click OK. The matched resources are added to the Selected Resources area. You can then adjust the selection as needed.
- The system automatically discovers and retrieves all resources from your cloud services. If you cannot find a target resource, check the following:
  - In the The total resource requests for all replicated pods exceed the recommended resource requests (4 vCores and 8 GB of memory). This may lead to quick consumption of resource plans. section, check whether resource synchronization is complete. If resources are still being synchronized (shown in a grayed-out state), wait for synchronization to finish. The time required depends on the number of resources.
  - If you still cannot find the resource after synchronization is complete, verify that your scenario supports initial certificate deployment. For more information, see Before you begin.
In the Task Preview panel, review the certificate and resource details. If everything looks correct, click Submit.
The preview page shows the number of matched certificates for each cloud service and the deployment quota to be consumed. A match count of 0 means the certificates do not match the resources, and the deployment will fail. Review your selections carefully.

Related operations

View deployment task details

On the Deployment to Cloud Services page, find the target deployment task and click Details in the Actions column.
On the task details page, you can view the deployment status of each instance resource. If a resource deployment fails, check the Actions column for the failure reason and take the appropriate action.
If you cannot determine the specific failure reason, contact your account manager for assistance.

Roll back a deployment task

Important

Deployment quota is not refunded after a successful rollback.

After a certificate is deployed successfully, if you find that the wrong certificate was deployed or you need to undo the deployment for another reason, you can roll back to the pre-deployment state:

On the Deployment to Cloud Services page, find the target deployment task and click Details in the Actions column.
On the task details page, click the cloud service, find the target instance resource, and then click Roll Back in the Actions column.
After a successful rollback, the task status changes to Rolled Back.

Delete a deployment task

Important

Deleted tasks cannot be recovered. Proceed with caution.

On the Deployment to Cloud Services page, find the target deployment task and click Delete in the Actions column. You can also select multiple deployment tasks and click Delete at the bottom of the list.

FAQ

Can SSL certificates be deployed to cloud products across different Alibaba Cloud accounts?

SSL certificates cannot be directly deployed across different accounts.

If accounts belong to the same entity that has completed identity verification, you can use the certificate sharing feature for free cross-account deployment. For more information, see Upload, sync, and share SSL certificates.
If the accounts belong to different entities, you must download the certificate from the original account and then manually upload and deploy it in the target account.

After a certificate is successfully deployed, is HTTPS automatically enabled on the cloud product?

No. A successful deployment in the Certificate Management Service console only means the certificate has been delivered to the corresponding cloud product. You must still go to that product's console to enable and configure it for HTTPS traffic.

Why is the number of cloud resources displayed as 0 during deployment?

When you create a deployment task, the system automatically discovers resources. If you cannot find a target resource, check the following:

In the Total Resources area, confirm that resource synchronization is complete. If resources are still being synchronized (indicated by a grayed-out state), wait. The synchronization time depends on the number of your resources.
If you still cannot find the resource after synchronization is complete, confirm if your scenario supports initial deployment. If not, you may need to deploy it in the console of the corresponding cloud product first. For more information, see initial configuration.