TLS (SSL) certificates for CDN resources

A TLS (SSL) certificate is a unique digital signature for a website. A certificate is required for a secure connection between the client and the server (HTTPS protocol) when transferring confidential information and performing financial transactions.

Selectel uses Let’s Encrypt® certificates and custom certificates.

Comparing certificate types

	Let’s Encrypt®	Personal
Domains	All CDN resource domains	Personal CDN resource domains specified in the certificate
Management	Cannot be managed	Delete certificate
Renewal	Automatically	Manually

Let’s Encrypt® certificate

A CDN resource can only have one active Let’s Encrypt® certificate, so it must specify all resource domains through which content needs to be distributed over HTTPS. If a domain is not specified in the certificate, content will only be distributed through it over HTTP.

A Let's Encrypt® certificate for default domains works immediately after creating a CDN resource. For custom domains, you need to issue a Let's Encrypt certificate manually.

The certificate does not need to be renewed manually; it is automatically reissued 30 days before the expiration date.

A Let’s Encrypt® certificate cannot be deleted, only replaced with a custom certificate.

For more information about Let’s Encrypt® certificate limits, see the Rate Limits article in the Let’s Encrypt® documentation.

Issue a Let’s Encrypt® certificate

Make sure that you created a CDN resource and added a custom domain.
In the control panel, in the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the menu of the section, click Issue SSL certificate.
Select the CDN resource for which you want to issue a certificate.
Click Issue.
Go to the CDN resources section.
Open the CDN resource page → the Certificates tab.
Select the Distribute via HTTPS through CNAME checkbox.
In the Certificate field, select the certificate you issued in step 6.
While applying settings, the CDN resource will be in the PROCESSING status. During this time, applying other settings is not available. The settings will be applied when the CDN resource changes to the ACTIVE status.

Personal certificate

A CDN resource can only have one certificate, so it must specify all resource domains through which content needs to be distributed over HTTPS. If a domain is not specified in the certificate, content will only be distributed through it over HTTP.

If you have your own TLS (SSL) certificate, you can upload it as a custom certificate.

Upload custom certificate

Make sure that you created a CDN resource and added a custom domain to the CDN resource.
In the control panel, in the top menu, click Products and select CDN.
Go to the Certificates for CDN resources section.
In the menu of the section, click Upload custom certificate.
Specify the certificate name. It will only be used in the control panel.
Add a certificate for the custom domain. It must begin with -----BEGIN CERTIFICATE----- and end with -----END CERTIFICATE-----.

You can add a certificate chain (main domain certificate, intermediate certificates, and root certificate) — make sure they form a complete chain. The Issuer value of the main certificate must match the Subject value of the first intermediate certificate, the Issuer value of the first intermediate certificate must match the Subject of the second intermediate certificate, and so on.
Add the private key of the certificate. It must begin with -----BEGIN PRIVATE KEY----- and end with -----END PRIVATE KEY-----.
Click Upload.
Go to the CDN resources section.
Open the CDN resource page → the Certificates tab.
Select the Distribute via HTTPS through CNAME checkbox.
In the Certificate field, select the certificate you uploaded in step 8.
While applying settings, the CDN resource will be in the PROCESSING status. During this time, applying other settings is not available. The settings will be applied when the CDN resource changes to the ACTIVE status.