TLS (SSL) certificates for user domains

To access objects in the backend via a custom domain over HTTPS, you must add a TLS (SSL) certificate. You can manage certificates through the control panel or Selectel Storage API.

You can issue a certificate from any provider. If you use Selectel DNS hosting, you can quickly issue a Let's Encrypt certificate, but you must add a certificate manually after each Let's Encrypt reissue.

The certificate is added at the country level: it will only work for buckets hosted in the region of the selected country.

One certificate can be active for one domain.If several certificates are added for a domain, the last one loaded will be active.If the active certificate is deleted or expires, the previous one will be automatically activated, but only if it has not expired.

TLS protocol

The Transport Layer Security (TLS) protocol is a new version of the SSL protocol and is used together with the HTTP protocol. When HTTP and TLS are used together, encryption, authentication and data integrity are ensured.

For your information

We recommend using TLS protocol version 1.2 or higher. Versions below 1.2 are considered deprecated (see IETF website for details) and are not supported by S3 as of May 1, 2023.

You can see the version of TLS being used in the logs.

Learn more about setting up TLS version 1.2 in Amazon's documentation:

Add a certificate

Up to 100 certificates can be added as part of the project.

In the control panel, on the top menu, click Products and select S3.
Go to the SSL Certificates section.
Click Add Certificate.
Select the country for baquets in which the certificate will work.
Enter a name for the certificate, it must be unique within the project.
Add a master certificate:
```
-----BEGIN CERTIFICATE-----
<certificate.crt>
-----END CERTIFICATE-----
```
Specify <certificate.crt> — private key in PKCS#1 format.
Add a private key:
```
-----BEGIN PRIVATE KEY-----
<private_key.key>
-----END PRIVATE KEY-----
```
Specify <private_key.key> — private key in PKCS#1 format.
Click Add Certificate. The certificate is activated within five minutes.

Certificate statuses

in progress	The certificate is validated (up to five minutes). In case of successful verification the status will change to `active`, and in case of error — to `error`
error	Certificate validation ended with an error, hover over the status to view the reason. Correct the error, delete the certificate and add it again
active	The certificate is active
expired	The certificate has expired. Delete the certificate and add a new one

Delete certificate

You cannot delete certificates that are in the process of being added.

In the control panel, on the top menu, click Products and select S3.
Go to the SSL Certificates section.
In the row with the certificate, click .
Enter a name for the certificate and click Delete.