---
title: "TLS (SSL) certificates for custom domains"
sidebar_label: "TLS (SSL) certificates"
sidebar_position: 4
description: "How to add, delete, and update a TLS (SSL) certificate for a custom domain"
---

import Formbricks from '@theme/MDXComponents/Formbricks'
import {CustomTable} from '@selectel/docux/components'
import CloseIcon from '@selectel/docux/icons/close'

# TLS (SSL) Certificates for User Domains

To access objects in a bucket via a [custom domain](/s3/manage/domains.mdx#user-domain) over HTTPS, you need to [add a TLS (SSL) certificate](#add-certificate). You can manage certificates through the [Control Panel](https://my.selectel.ru/) or the [User Certificates API](/api/certificates-manager/).

You can issue a certificate with any provider. If you use [Selectel DNS hosting](/dns-hosting/), you can quickly issue a [Let’s Encrypt certificate](/certificates-manager/certificates/lets-encrypt.mdx), but you must manually add the certificate after each Let’s Encrypt renewal.

The certificate is added at the country level: it will only work for buckets hosted in the region of the selected country. A single certificate cannot be used across multiple [projects](/access-control/projects/).

Only one certificate can be active for a single domain. If multiple certificates are added for a domain, the last uploaded one will be the active one. If the active certificate is [deleted](#delete-certificate) or expires, the previous one will be automatically activated, but only if it has not expired.

## TLS Protocol \{#tls-protocol}

The Transport Layer Security (TLS) protocol is a newer version of the SSL protocol and is used in conjunction with the HTTP protocol. Using HTTP and TLS together ensures data encryption, authentication, and integrity.

:::info

We recommend using the TLS protocol version 1.2 or higher. Versions below 1.2 are considered obsolete (read more on the [IETF website](https://datatracker.ietf.org/doc/rfc8996/)) and have not been supported by S3 since May 1, 2023.

:::

You can view the TLS version in use in the logs.

Learn more about configuring TLS version 1.2 in the Amazon documentation:

* [AWS SDK for Java](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/security-java-tls.html)
* [AWS SDK for .NET](https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/enforcing-tls.html)
* [AWS SDK for JavaScript](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/enforcing-tls.html)

## Add certificate \{#add-certificate}

You can add up to 100 certificates per project.

1. In the [control panel](https://my.selectel.ru/storage/), click **Products** in the top menu and select **S3**.

2. Go to the **SSL Certificates** section.

3. Click **Add certificate**.

4. Select the country for buckets in which the certificate will work.

5. Enter a name for the certificate; it must be unique within the project.

6. Add a primary certificate:

   ```bash
   -----BEGIN CERTIFICATE-----
   <certificate.crt>
   -----END CERTIFICATE-----
   ```

   Specify `<certificate.crt>` — the private key in `PKCS#1` format.

7. Add a private key:

   ```bash
   -----BEGIN PRIVATE KEY-----
   <private_key.key>
   -----END PRIVATE KEY-----
   ```

   Specify `<private_key.key>` — the private key in `PKCS#1` format.

8. Click **Add certificate**. The certificate will be activated within five minutes.

### Certificate statuses \{#certificate-statuses}

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>in progress</th><td>The certificate is undergoing verification (up to five minutes). If successful, the status will change to `active`, or to `error` in case of an error</td>
      </tr>

      <tr>
        <th>error</th><td>Certificate verification failed. To view the reason, hover over the status. Fix the error, [delete the certificate](#delete-certificate), and [add it](#add-certificate) again.</td>
      </tr>

      <tr>
        <th>active</th><td>Certificate is active</td>
      </tr>

      <tr>
        <th>expired</th><td>The certificate has expired. [Delete the certificate](#delete-certificate) and [add a new one](#add-certificate).</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Delete certificate \{#delete-certificate}

You cannot delete certificates that are currently being added.

1. In the [control panel](https://my.selectel.ru/storage/), click **Products** in the top menu and select **S3**.
2. Go to the **SSL Certificates** section.
3. In the certificate line, click <CloseIcon />.
4. Enter the certificate name and click **Delete**.

<Formbricks />