TLS (SSL) certificates for CDN resources

A TLS (SSL) certificate is a unique digital signature for a website. A certificate is required for a secure connection between the client and the server (HTTPS protocol) when transferring confidential information and performing financial transactions.

Selectel uses Let’s Encrypt® certificates and personal certificates.

Comparing certificate types

	Let’s Encrypt®	Personal
Domains	All CDN resource domains	Personal CDN resource domains specified in the certificate
Management	Cannot be managed	Delete certificate
Renewal	Automatically	Manually

Let’s Encrypt® certificate

A CDN resource can have only one active Let’s Encrypt® certificate.

A Let's Encrypt® certificate for default domains becomes active immediately after creating a CDN resource. For personal domains, you must issue a Let's Encrypt certificate manually.

The certificate does not need to be renewed manually; it is automatically reissued 30 days before the expiration date.

A Let’s Encrypt® certificate cannot be deleted, only replaced with a personal certificate.

Read more about Let’s Encrypt® certificate limitations in the Rate Limits section of the Let’s Encrypt® documentation.

Issue a Let’s Encrypt® certificate

Verify that you have created a CDN resource and added a personal domain.
In the control panel, on the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the section menu, click Issue SSL certificate.
Select the CDN resource for which you want to issue a certificate.
Click Issue.
Go to the CDN resources section.
Open the CDN resource page → Certificates tab.
Select the HTTPS distribution via CNAME checkbox.
In the Certificate field, select the certificate you issued in step 6.
Click Apply. While settings are being applied, the CDN resource enters the PROCESSING status. You cannot apply other settings during this time. Settings take effect when the CDN resource transitions to ACTIVE.

Personal certificate

If you have your own TLS (SSL) certificate, you can upload it as a personal certificate.

The certificate must include personal domains of the CDN resource through which you want to deliver content over HTTPS.

A CDN resource can only have one certificate, so it must contain all resource domains through which you want to deliver content over HTTPS. If a domain is not specified in the certificate, content will only be delivered over HTTP for that domain.

If you delete a personal certificate, you must issue a Let’s Encrypt® certificate for the CDN resource.

Upload a personal certificate

Verify that you have created a CDN resource and added a personal domain to the CDN resource.
In the control panel, on the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the section menu, click Upload custom certificate.
Enter a certificate name. It will only be used in the control panel.
Add a certificate for a personal domain. It must start with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

You can add a certificate chain (the domain certificate, intermediate certificates, and root certificate) — ensure they form a complete chain. The Issuer value of the domain certificate must match the Subject value of the first intermediate certificate, the Issuer value of the first intermediate certificate must match the Subject value of the second intermediate certificate, and so on.
Add the certificate private key. It must start with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.
Click Upload.
Go to the CDN resources section.
Open the CDN resource page → Certificates tab.
Select the HTTPS distribution via CNAME checkbox.
In the Certificate field, select the certificate you uploaded in step 8.
Click Apply. While settings are being applied, the CDN resource enters the PROCESSING status. You cannot apply other settings during this time. Settings take effect when the CDN resource transitions to ACTIVE.