ApsaraVideo Live:HTTPS settings

Introduction

Hypertext Transfer Protocol Secure (HTTPS) is an HTTP channel secured using the SSL or TLS protocol. ApsaraVideo Live provides an HTTPS secure acceleration solution that lets you view, disable, enable, and edit certificates. If a certificate is correctly configured and enabled, both HTTP and HTTPS access are supported. If the certificate does not match the domain name or is disabled, only HTTP access is available.

Benefits of HTTPS acceleration

• Encrypts sensitive user information during transmission, preventing security risks such as session ID or cookie leakage if an attacker intercepts the traffic.

• Performs data integrity checks during transmission to prevent man-in-the-middle (MITM) attacks, such as DNS hijacking, content hijacking, or tampering.

Precautions

Step 1: Purchase a certificate

To enable Enable HTTPS, you need a certificate that matches the accelerated domain name. You can go to the Certificate Service page and click Buy Now to purchase a certificate. If you already have your own certificate, you can skip this step.

Step 2: Configure a streaming domain

1. Enable HTTPS secure acceleration.

   1. Log on to the ApsaraVideo Live console.

   2. In the left-side navigation pane, click Domain Names. The Domain Management page appears.

   3. Select the streaming domain for which you want to configure HTTPS secure acceleration, and click Domain Settings.

   4. Click HTTPS Settings and turn on the HTTPS Certificate switch.

2. Select a certificate.

   • Alibaba Cloud Security certificate: For the certificate type, click Alibaba Cloud Security. Select a certificate that you purchased from Certificate Service. Choose the certificate by its name to match the accelerated domain name.

   • Your own certificate: For the certificate type, click Others. Enter a certificate name, and upload the certificate content and private key. The certificate is saved in the Alibaba Cloud Security console. You can view it in the My Certificates section.

     Note

     Only the PEM certificate format is supported.

Introduction

HTTP/2, also known as HTTP 2.0, introduces features such as multiplexing, HTTP header compression, request prioritization, and server push compared to HTTP 1.1. It resolves limitations in HTTP 1.1, optimizes request performance, and maintains compatibility with HTTP 1.1 semantics. Browsers including Chrome, Edge, Safari, and Firefox support the HTTP/2 protocol.

Benefits of HTTP/2

• Binary protocol: Unlike HTTP 1.x, which relies on text-based parsing, HTTP/2 splits all transmitted information into smaller messages and frames encoded in binary format. This binary structure enhances protocol extensibility—for example, by enabling dedicated frames for data and instructions.

• Multiplexing: In HTTP 1.x, performance optimizations often involve techniques like sprites or multiple domain names due to browser-imposed limits on concurrent requests per domain. When a page requires many resources, head-of-line (HOL) blocking forces subsequent requests to wait. HTTP/2, built on a binary framing layer, allows simultaneous transmission of multiple requests and responses over a single TCP connection. These are reassembled at the receiving end using stream identifiers and headers, eliminating HOL blocking and significantly improving transmission performance.

• Header compression: HTTP request headers contain substantial repeated information. HTTP/2 uses the HPACK compression format, where both endpoints maintain a cached index table of header fields. For identical headers, only the index number is transmitted, enhancing efficiency and speed.

• Server Push: The server can proactively send multiple responses for a single client request, delivering resources to the client without waiting for explicit requests.

Precautions

Before performing this operation, ensure that HTTPS secure acceleration is configured.

Enable or disable HTTP/2

1. Log on to the ApsaraVideo Live console.

2. In the left-side navigation pane, click Domain Names. The Domain Management page appears.

3. Find the streaming domain that you want to configure and click Domain Settings in the Actions column.

4. In the navigation pane on the left for the domain, click HTTPS Settings.

5. In the HTTP/2 section, turn the HTTP/2 feature on or off.

Introduction

If you have enabled HTTPS secure acceleration for your accelerated domain name, you can customize settings to force a redirect of the original request from an end user.

For example, if you enable HTTP > HTTPS, an end user sends an HTTP request. The server returns an HTTP 301 status code response, forcibly redirecting the original HTTP request to an HTTPS request, as shown in the following figure.

Procedure

1. Log on to the ApsaraVideo Live console.

2. In the left-side navigation pane, click Domain Names. The Domain Management page appears.

3. Find the streaming domain that you want to configure and click Domain Settings in the Actions column.

4. Click Streaming Management > HTTPS Settings.

5. Click Change Settings.

   

6. Select a Redirect Type.

   

   Redirect Type	Description
   Default	Both HTTP and HTTPS requests are supported.
   HTTPS > HTTP	Requests from clients to points of presence (POPs) are forcibly redirected to HTTP.
   HTTP > HTTPS	Requests from clients to POPs are forcibly redirected to HTTPS to ensure access security.

7. Click OK.

Methods to convert certificate formats

HTTPS secure acceleration supports only certificates in PEM format. If your certificate is in a different format, you must convert it to PEM. You can use the OpenSSL tool to perform the conversion. The following table describes how to convert certificates from several common formats to the PEM format.