TLS/SSL Certificates
Last updated
Was this helpful?
Last updated
Was this helpful?
In this section, you'll be able to review the existing certificates, edit them or add a new one.
You can manage your certificates in three ways:
A custom certificate is the one that you already possess and want to import to the CDN, and for which you are responsible for keeping updated.
Autogenerated certificates are managed by our CDN and are renewed automatically.
If you already have a digital certificate for your domain, you can easily import it to the CDN. All you need is the certificate in format.
To import a certificate, you must have two files: one with the full chain of the certificate and another with the private key, both coded in Base64 (normally with the extension .pem or .crt). Many certificate providers often give several format options when the certificate is downloaded.
You'll know if the format is correct if you can see the fields “BEGIN CERTIFICATE” and “END CERTIFICATE” when opened in a text editor.
If you must concatenate the full chain of the certificate yourself, the correct way of doing so is as follows:
If everything is OK, log in to our dashboard:
Provisioning > Certificates > New > Custom cert
A window will be display where you'll be able to paste the contents of the public and private key of your certificate.
Now click on "Create". If the certificate is correct, it'll be added to your account and you'll be able to see it in the table along with the rest of the certificates. Alongside this, a process will be triggered to deploy that certificate in the CDN. This process takes no longer than 5 minutes, after which the domains matching that certificate will automatically use it.
The renewal process is easy, and the date on which the certificate will expire can be viewed in the dashboard so that it can be planned in advance (you will also receive e-mail notification). It basically consists of editing the current certificate (by clicking on the pencil icon).
Only custom certificates can be edited directly; all the other types (autogenerated HTTP and autogenerated DNS) can only be viewed or removed from your account, as they're managed and renewed internally.
This type is managed by the CDN, and both their initial expedition and further renewals are automatic provided one basic requirement is met: the domain must point at DNS level to the CDN.
To obtain a new certificate, a "Certificate Request" must be created:
Select the domains that will form part of the certificate. Optionally, you can check the "Standalone" option, which will make sure that this certificate will not merge with other HTTP certificates on your account. We recommend leaving this unchecked if not strictly necessary.
When you click on "Create", a new "Certificate Request" will be expedited and displayed in the request log, where you can consult the status of your request.
You can consult the request log at any time:
This type is also managed by the CDN, and the main difference is that the certificates are generated through a DNS challenge.
Requirements:
A compatible DNS provider (you can check the list of providers supported in the credentials management section that will be explained below)
Possess the required keys to updated DNS records
First of all, create the necessary credentials to update DNS records in your provider. In this example AWS Route53, or at least, the necessary record, which in our example would be _acme-challenge.example.com.
Provisioning > Certificates > Options > DNS Credentials Manager
A table will be displayed with the current credentials. Click on the "New Credential" button.
Enter an alias to identify this credential and select the DNS provider, in this example "AWS (Route53").
The necessary fields for the credential will be displayed automatically, which differ among providers – check your provider documentations or contact us in case of doubt.
When you're done, click on "Create".
You can edit or delete credentials in this same section. Remember that the renewals of the certificates generated with the DNS challenge will use the credentials assigned with the values they have at that time.
Now that we have the required credentials, we will create the certificate request:
Provisioning > Certificates > New > Certificate request (DNS challenge)
A wizard will be displayed in which you must enter the domains to be included in the new certificate. In this example, the following must be entered on individual lines:
In the next section, select the credential to be associated with this “DNS certificate request”, remembering that these requests are permanent and are reused when the certificate is renewed. Therefore, if the credentials change, these must be updated accordingly.
Once the certificate request is created, a table will be displayed containing the active DNS requests and where the request status can be consulted.
If the certificate is generated, it will be displayed automatically in the table in the certificates section.
If you've delegated the DNS management of your domain to our CDN, you won't need to provide any credentials upfront, although you will have to create a credential object with our provider to attach it to the Certificate Requests. Follow the usual steps to create a new credential and select Transparent Edge DNS.
No secrets required, but you will need to create a "CNAME Verification" type credential:
The CNAME that you will need to point to your domains to will be displayed, which will be the same for all the domains, but different per company, for example:
5fb5c7b9ef2b82.tls-validation.edge2befaster.net
Now, if you want to create a certificate for:
You'll need to create two CNAME records (because the wildcard *.example.com and example.com validate in the same DNS record)
Once you have the CNAMEs in place and they've replicated, create a certificate request:
When asked to provide a credential, select the alias that you gave to the "CNAME Verification".
If certificate generation fails, an error message will appear either in the HTTP Requests History or in the Active DNS Requests, depending on the certificate challenge type. If the error message does not provide enough information, please reach out to our support team for assistance in diagnosing the issue.
This means that the domains do not necessarily have to point to the CDN and it has one big advantage: certificates can be requested.
If you have delegated the DNS to Transparent Edge, you don’t have to have any key and the above requirements are automatically met. All you have to do is create a credential with the "" provider.
This method works like the Autogenerated DNS Certificate but it leverages on a CNAME or alias to validate against .
For domains or subdomains with CAA records, ensure that “letsencrypt.org” is allowed, as it is the default Certificate Authority. You can find more details on configuring CAA records .
