Manage TLS(SSL) certificates for a CDN resource

A TLS(SSL) certificate is a unique digital signature of a website. A certificate is required for a secure connection between a client and a server (HTTPS protocol) when transmitting confidential information and performing financial transactions.

Selectel uses Let’s Encrypt® certificates and personal certificates.

Comparison of certificate types

	Let’s Encrypt®	Personal
Domains	All CDN resource domains	Personal CDN resource domains specified in the certificate
Management	Cannot be managed	Delete certificate
Renewal	Automatically	Manually

Let’s Encrypt® certificate

A CDN resource can have only one active Let’s Encrypt® certificate.

The Let's Encrypt® certificate for default domains becomes active immediately after creating a CDN resource. For personal domains, you need to issue a Let's Encrypt certificate manually.

There is no need to renew the certificate manually — it is automatically renewed 30 days before the expiration date.

A Let’s Encrypt® certificate cannot be deleted; it can only be replaced with a personal certificate.

Learn more about Let’s Encrypt® certificate limitations in the Rate Limits section of the Let’s Encrypt® documentation.

Issue a Let’s Encrypt® certificate

Ensure that you have created a CDN resource and added a personal domain.
In the control panel, on the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the menu of the section, click Issue SSL certificate.
Select the CDN resource for which you want to issue a certificate.
Click Issue.
Go to the CDN resources section.
Open the CDN resource page → Certificates tab.
Select the HTTPS delivery via CNAME checkbox.
In the Certificate field, select the certificate you issued in Step 6.
Click Apply. While settings are being applied, the CDN resource enters the PROCESSING status. You cannot apply other settings during this time. Settings will be applied once the CDN resource reaches the ACTIVE status.

Personal certificate

If you have your own TLS(SSL) certificate, you can upload it as a personal certificate.

The certificate must include personal domains of the CDN resource that will be used to deliver content over HTTPS.

A CDN resource can have only one certificate, so it must include all resource domains through which content should be delivered over HTTPS. If a domain is not specified in the certificate, content will only be delivered over HTTP for that domain.

If you delete a personal certificate, you will need to issue a Let’s Encrypt® certificate for the CDN resource.

Upload personal certificate

Ensure that you have created a CDN resource and added a personal domain to the CDN resource.
In the control panel, on the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the menu of the section, click Upload custom certificate.
Specify a certificate name. It will only be used in the control panel.
Add a certificate for a custom domain. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

You can add a certificate chain (domain certificate, intermediate, and root) — ensure they form a complete chain. The Issuer value of the main certificate must match the Subject value of the first intermediate certificate, the Issuer value of the first intermediate certificate with the Subject of the second intermediate, and so on.
Add the certificate’s private key. It must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.
Click Upload.
Go to the CDN resources section.
Open the CDN resource page → Certificates tab.
Select the HTTPS delivery via CNAME checkbox.
In the Certificate field, select the certificate you uploaded in Step 8.
Click Apply. While settings are being applied, the CDN resource enters the PROCESSING status. You cannot apply other settings during this time. Settings will be applied once the CDN resource reaches the ACTIVE status.