---
title: "TLS (SSL) certificates for CDN resources"
sidebar_label: "TLS (SSL) certificates"
description: "Types of TLS (SSL) certificates available and how to add a certificate to a domain"
sidebar_position: 6
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import AddSslCertificate from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cdn/add-ssl-certificate.mdx'
import {CustomTable} from '@selectel/docux/components'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'

# TLS (SSL) certificates for CDN resources

A TLS (SSL) certificate is a unique digital signature for a website. A certificate is required for a secure connection between the client and the server (HTTPS protocol) when transferring confidential information and performing financial transactions.

Selectel uses [Let’s Encrypt® certificates](#lets-encrypt-certificate) and [personal certificates](#personal-certificate).

## Comparing certificate types \{#tls-ssl-certificate-types-comparison}

<CustomTable>
  <table>
    <thead>
      <tr>
        <th data-noborder />

        <th data-noborder>Let’s Encrypt®</th><th data-noborder>Personal</th>
      </tr>
    </thead>

    <tbody>
      <tr>
        <th>Domains</th><td>All CDN resource domains</td><td>Personal CDN resource domains specified in the certificate</td>
      </tr>

      <tr>
        <th>Management</th><td>Cannot be managed</td><td>Delete certificate</td>
      </tr>

      <tr>
        <th>Renewal</th><td>Automatically</td><td>Manually</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Let’s Encrypt® certificate \{#lets-encrypt-certificate}

A CDN resource can have only one active Let’s Encrypt® certificate.

A Let's Encrypt® certificate for [default domains](/cdn/resources/domains.mdx#default-domain) becomes active immediately after creating a CDN resource. For [personal domains](/cdn/resources/domains.mdx#personal-domain), you must [issue a Let's Encrypt certificate](#generate-lets-encrypt-certificate) manually.

The certificate does not need to be renewed manually; it is automatically reissued 30 days before the expiration date.

A Let’s Encrypt® certificate cannot be deleted, only replaced with a [personal certificate](#personal-certificate).

Read more about Let’s Encrypt® certificate limitations in the [Rate Limits](https://letsencrypt.org/docs/rate-limits/) section of the Let’s Encrypt® documentation.

### Issue a Let’s Encrypt® certificate \{#generate-lets-encrypt-certificate}

1. Verify that you have [created a CDN resource](/cdn/create-resource.mdx) and [added a personal domain](/cdn/resources/add-personal-domain.mdx).

2. In the [control panel](https://my.selectel.ru/cdn-v3), on the top menu, click **Products** and select **CDN**.

3. Go to the **Certificates for CDN resources** section.

4. In the  section menu, click **Issue SSL certificate**.<MoreVerticalIcon />

5. Select the CDN resource for which you want to issue a certificate.

6. Click **Issue**.

7. Go to the **CDN resources** section.

8. Open the CDN resource page → **Certificates** tab.

9. Select the **HTTPS distribution via CNAME** checkbox.

10. In the **Certificate** field, select the certificate you issued in step 6.

11. Click **Apply**. While settings are being applied, the CDN resource will be in the `PROCESSING` status. You cannot apply other settings during this time. Settings will take effect when the CDN resource transitions to the `ACTIVE`.

## Personal certificate \{#personal-certificate}

If you have your own TLS (SSL) certificate, you can [upload it](#upload-personal-certificate) as a personal certificate.

The certificate must specify the [personal domains](/cdn/resources/domains.mdx#personal-domain) of the CDN resource through which you want to deliver content over HTTPS.

A CDN resource can only have one certificate, so it must contain all resource domains through which you want to deliver content over HTTPS. If a domain is not specified in the certificate, content will only be delivered over HTTP for that domain.

If you delete a personal certificate, you will need to [issue a Let’s Encrypt® certificate](#generate-lets-encrypt-certificate) for the CDN resource.

### Upload a personal certificate \{#upload-personal-certificate}

1. Ensure that you have [created a CDN resource](/cdn/create-resource.mdx) and [added a personal domain](/cdn/resources/add-personal-domain.mdx) to the CDN resource.

2. In the [control panel](https://my.selectel.ru/cdn-v3), click **Products** in the top menu and select **CDN**.

3. Go to the **Certificates for CDN resources** section.

4. In the  section menu, click **Upload custom certificate**.<MoreVerticalIcon />

5. Enter a certificate name. It will only be used in the control panel.

6. Add the certificate for the personal domain. It must start with `-----BEGIN CERTIFICATE-----` and end with `-----END CERTIFICATE-----`.

   You can add a certificate chain (the primary certificate for the domain, intermediate, and root certificates) — ensure they create a complete chain. The `Issuer` value of the primary certificate must match the `Subject` value of the first intermediate certificate, the `Issuer` value of the first intermediate certificate must match the `Subject` value of the second intermediate certificate, and so on.

7. Add the certificate private key. It must start with `-----BEGIN PRIVATE KEY-----` and end with `-----END PRIVATE KEY-----`.

8. Click **Upload**.

9. Go to the **CDN resources** section.

10. Open the CDN resource page → **Certificates** tab.

11. Select the **HTTPS distribution via CNAME** checkbox.

12. In the **Certificate** field, select the certificate you uploaded in step 8.

13. Click **Apply**. While settings are being applied, the CDN resource will be in the `PROCESSING` status. You cannot apply other settings during this time. Settings will take effect when the CDN resource transitions to the `ACTIVE`.

<Formbricks />