If your website uses HTTPS, you must upload an SSL certificate. This way, Anti-DDoS Proxy can scrub HTTPS traffic. This topic describes how to upload an SSL certificate.
Usage notes
If the SSL certificate of your website is changed, update the certificate in the Anti-DDoS Proxy console. Otherwise, HTTPS traffic cannot be processed as normal.
Anti-DDoS Proxy (Chinese Mainland) supports certificates that use internationally accepted algorithms and ShangMi (SM) certificates. Anti-DDoS Proxy (Outside Chinese Mainland) supports only certificates that use internationally accepted algorithms.
If your website supports both certificates that use internationally accepted algorithms and SM certificates, you must upload certificates of the two types.
Prerequisites
A website that supports HTTPS is added to Anti-DDoS Proxy. For more information, see Add websites.
The certificate is uploaded to the Certificate Management Service console. For more information, see Upload an SSL certificate.
Upload a certificate that uses internationally accepted algorithms
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.
Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland), select Outside Chinese Mainland.
In the left-side navigation pane, choose .
On the Website Config page, find the domain name that you want to manage and click the
icon to the right of SSL Certificate in the Certificate Status column. In the Upload Certificate and Private Key dialog box, select an existing certificate.
Select Existing Certificate: If you have uploaded a certificate to Certificate Management Service, you can select the certificate.
Upload: If you have not uploaded a certificate to Certificate Management Service, you can manually upload a certificate. Specify Certificate Name, copy and paste the content of the certificate file to the Certificate File field, and then copy and paste the content of the private key file to the Private Key field.
NoteIf the certificate file is in the PEM, CER, or CRT format, you can use a text editor to open the certificate file and copy the file content. If the certificate file is in other formats, such as PFX and P7B, you must convert the file into the PEM format and then use a text editor to open the file and copy the file content. For information about how to convert the format of a certificate file, see Use the certificate toolkit or How do I convert an HTTPS certificate to the PEM format?
If the certificate file includes multiple certificates, such as a certificate chain, you must concatenate the content of these certificates and copy the concatenated content to the Certificate File field.
Upload an SM certificate
After you upload the SM certificate, if you want Anti-DDoS Proxy (Chinese Mainland) to protect requests from clients on which an SM certificate is installed, you must turn on Enable SM Certificate-based Verification in the TLS Security Settings dialog box. For more information, see Configure a custom TLS security policy.
If clients do not support server name indication (SNI), Anti-DDoS Proxy (Chinese Mainland) returns the default SM certificate, and the message "The server certificate cannot be trusted" is displayed.
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select Chinese Mainland.
In the left-side navigation pane, choose .
On the Website Config page, find the domain name that you want to manage and click the
icon to the right of SM Certificate in the Certificate Status column. In the Upload Certificate and Private Key dialog box, upload an SM certificate.
You must upload an SM certificate to Certificate Management Service before you can select the certificate.