'%20transform='translate(102%20102)%20scale(.8)'/%3e%3c/svg%3e){kind=small}
Content Delivery Network
HTTPS certificates and redirects
Configure a domain certificate and verify HTTPS before redirecting HTTP traffic.
Where to start
Go to CDN → Domain management, open the domain configuration and choose HTTPS. Prepare a valid certificate covering the acceleration domain and its matching private key.
Prepare a matching certificate
The certificate must cover the actual acceleration domain, be valid, and include the matching private key and required chain. Check the origin certificate separately from the certificate the CDN serves to visitors.
Enter private keys only in trusted certificate settings. Never include them in guides, support screenshots or public links.
Fields for your own certificate
| Field | What to enter | Common mistakes |
|---|---|---|
| Certificate name | For example, download-example-com. Start with a letter; use at most 65 characters: letters, digits, - / . _ * | Chinese characters and spaces are unsupported; the name does not change domain coverage |
| Certificate content | The acceleration domain's PEM certificate | A certificate covering only example.com cannot be used for x.example.com |
| Private key content | The complete PEM private key matching the certificate | Password-encrypted keys are unsupported; do not enter a CSR or another certificate's key |
| Certificate chain | Intermediate certificates from the issuer | A missing chain can cause verification failures on some devices |
Configuration steps
- Enable HTTPS and choose Existing certificate ID or Upload your own certificate under Certificate source.
- For an existing certificate, enter its ID. For an upload, enter the name, certificate and private key, plus intermediate certificates if needed. Preserve all PEM BEGIN and END lines.
- Select Save HTTPS settings, review the confirmation and choose Save and submit. If activation is not confirmed, resolve the stated cause before enabling redirects.
- After saving, select Sync configuration. Visit a real file using the HTTPS acceleration domain and check the certificate received by the browser and the file content.
- Once HTTPS works, optionally enable HTTP to HTTPS redirect, choose 301 or 302 and save. Finally, check the redirect destination from the original HTTP URL.
Choosing 301 or 302
Avoid loops where the origin redirects to HTTP while the CDN forces HTTPS. Test HTTP/2 and TLS versions against your actual clients.
| Option | Meaning and impact |
|---|---|
| 301 | Permanent redirect. Clients may cache it, so future changes must account for cached redirects. |
| 302 | Temporary redirect, suitable for validation or a temporary migration. |
Checks after renewing a certificate
Update before expiry, then inspect the domain coverage and validity of the certificate the browser actually receives. An upload-success message alone is insufficient.
Incomplete chains, mismatched keys and uncovered domains can break HTTPS. Do not ignore browser certificate warnings to declare success.
What to verify after saving
The browser must open a real HTTPS resource without bypassing certificate warnings. Domain coverage and validity must be correct, and content must match the origin. If redirects are enabled, HTTP must lead to the expected HTTPS path.
Enabled (form setting) only reflects the current switch value. It is not proof of activation if saving failed, certificate upload succeeded but binding failed, or configuration has not synced.