Add an HTTPS listener

Updated at: 2025-03-21 08:53

HTTPS is an extension of HTTP and uses the SSL/TLS protocol to encrypt data transmission between clients and servers. If your services need to transmit sensitive data, such as user or identity information, or if you want to enhance service security, you can add an HTTPS listener to your Classic Load Balancer (CLB) instance to forward HTTPS requests from clients.

Prerequisites

A CLB instance is created.

Limits

When you configure an HTTPS listener, the backend protocol can only be set to HTTP. Therefore, the port for the backend server must be set to the HTTP port (typically 80) rather than the HTTPS port (typically 443), and HTTP ports cannot be configured for HTTP-to-HTTPS redirection.

Usage notes

  • By default, the timeout period of session tickets for HTTPS listeners is 300 seconds.

  • The actual amount of data transfer on an HTTPS listener is greater than the billed amount because a portion of data is used for handshaking.

  • Therefore, the amount of data transfer greatly increases when a large number of connections are established.

Procedure

Step 1: Add an HTTPS listener

  1. Log on to the CLB console.

  2. In the top navigation bar, select the region where the CLB instance is deployed.

  3. On the Instances page, find the CLB instance that you want to manage, and choose one of the following ways to configure an HTTPS listener:

    • Click Configure Listener in the Actions column.

    • Click the ID of the CLB instance that you want to manage. On the Listener tab of the instance details page, click Add Listener.

  4. In the Protocol & Listener step, configure the following parameters and click Next.

    Parameter

    Description

    Select Listener Protocol

    Select a listener protocol.

    In this example, HTTPS is selected.

    Backend Protocol

    In this example, an HTTPS listener is used. Backend Protocol is automatically set to HTTP and cannot be changed.

    Listener Port

    Specify the listening port to receive and forward requests to backend servers. Valid values: 1 to 65535.

    Tag

    Select or enter a Tag Key and a Tag Value.

    Advanced Settings

    Click Modify to configure advanced settings.

    Scheduling Algorithm

    Select a scheduling algorithm. Default value: Round Robin (RR).

    • Weighted Round-robin (WRR): Backend servers that have higher weights receive more requests than backend servers that have lower weights.

    • Round Robin (RR): Requests are distributed to backend servers in sequence.

    For more information about the scheduling algorithm and the applicable scenarios, see SLB scheduling algorithms.

    Session Persistence

    By default, session persistence is disabled.

    After session persistence is enabled, CLB forwards all requests that are from the same client to the same backend server.

    Cookie Option:

    • Insert Cookie: If you select this option, you need to only specify the timeout period of the cookie.

      CLB inserts a cookie (SERVERID) into the first HTTP or HTTPS response that is sent to a client. The next request from the client contains the cookie, and the listener forwards the request to the recorded backend server.

      Session Persistence Timeout Period: If you select Insert Cookie, specify a timeout period for session persistence.

    • Rewrite cookie: If you select this option, you can specify the cookie that you want to insert into an HTTP or HTTPS response. In this case, you must specify the timeout period and lifetime of the cookie on a backend server.

      After you specify a cookie, CLB overwrites the original cookie with the specified cookie. The next time CLB receives a client request that contains the specified cookie, the listener distributes the request to the recorded backend server.

      Cookie Name: If you select Rewrite Cookie, you must specify a name for the cookie.

    Enable HTTP/2

    By default, HTTP/2 is enabled.

    HTTP/2 provides the multiplexing feature. If a listener of a CLB instance supports the HTTP/2 protocol, the instance can use a single TCP connection to forward multiple HTTP requests and responses, which greatly enhances the transmission speed.

    Access Control

    Specify whether to enable access control. By default, access control is disabled.

    Select an access control method after you enable access control. Then, select an access control list (ACL) as the whitelist or blacklist of the listener.

    • Whitelist: Allows Specified IP Addresses to Access the SLB Instance. Only requests from the IP addresses or CIDR blocks specified in the network ACL are forwarded. Whitelists apply to scenarios in which you want to allow access only from specific IP addresses. Your service may be adversely affected if the whitelist is not properly configured. After a whitelist is configured, only requests from IP addresses that are added to the whitelist are forwarded by the listener.

      If a whitelist is configured but no IP address is added to the whitelist, the listener forwards all requests.

    • Blacklist: Forbids Specified IP Addresses to Access the SLB Instance. Requests from the IP addresses or CIDR blocks specified in the network ACL are denied. Blacklists apply to scenarios in which you want to deny access from specific IP addresses.

      If a blacklist is configured but no IP address is added to the blacklist, the listener forwards all requests.

    • Whitelist: Only requests from the IP addresses or CIDR blocks specified in the network ACL are forwarded. Whitelists apply to scenarios in which you want to allow access only from specific IP addresses. Your service may be adversely affected if the whitelist is not properly configured. After a whitelist is configured, only requests from IP addresses that are added to the whitelist are forwarded by the listener.

      If a whitelist is configured but no IP address is added to the whitelist, the listener forwards all requests.

    • Blacklist: Requests from the IP addresses or CIDR blocks specified in the network ACL are denied. Blacklists apply to scenarios in which you want to deny access from specific IP addresses.

      If a blacklist is configured but no IP address is added to the blacklist, the listener forwards all requests.

    Note

    IPv6 instances can be associated only with IPv6 network ACLs, and IPv4 instances can be associated only with IPv4 network ACLs. For more information about how to create a network ACL, see Create a network ACL.

    Bandwidth Throttling for Listeners

    If a pay-by-bandwidth CLB instance is used, you can set a maximum bandwidth for each listener to limit the amount of network traffic forwarded by listeners. The sum of the maximum bandwidth of all listeners that are added to an SLB instance cannot exceed the maximum bandwidth of the SLB instance.

    By default, this feature is disabled and all listeners share the bandwidth of the CLB instance. For more information about how the listeners of a CLB instance can share the bandwidth of the CLB instance, see Enable bandwidth sharing among listeners of a CLB instance.

    Important
    • For example, the maximum bandwidth of an Internet-facing CLB instance is 5 Mbit/s, and you configure two listeners. You allocate 5 Mbit/s of bandwidth to Listener A, and do not allocate bandwidth to Listener B. In this case, Listener B is inaccessible. Exercise caution when you allocate bandwidth.

    • If three listeners are configured for an internal-facing CLB instance, and the total bandwidth allocated to Listener A and Listener B is 5,120 Mbit/s, Listener C is inaccessible. Exercise caution when you allocate bandwidth.

    • If a pay-by-data-transfer CLB instance is used, the bandwidth of listeners is unlimited by default.

    Idle Connection Timeout Period

    The maximum duration for which the TCP connection between a CLB instance and a client can remain open without data transmission. Default value: 1 to 60. Unit: seconds.

    If no request is received within the specified timeout period, CLB closes the connection. When another request is received, CLB establishes a new connection.

    Note

    This timeout period applies to all servers group associated with the listener. If you want to specify another timeout period for a specific backend server, create a separate listener for this backend server and set the timeout period that you want.

    Connection Request Timeout

    If no response is received from the backend server within the request timeout period, CLB returns the HTTP 504 error code to the client.

    Default value: 1 to 180. Unit: seconds.

    Gzip Compression

    If you enable GZIP compression, files of specific types are compressed. If you disable GZIP compression, no file is compressed. By default, data compression is enabled for Gzip.

    GZIP supports the following file types: text/xml, text/plain, text/css, application/javascript, application/x-javascript, application/rss+xml, application/atom+xml, and application/xml.

    Custom HTTP Header

    Select the HTTP headers that you want to add. Valid values:

    • X-Forwarded-For: Retrieve Client IP: obtains client IP addresses.

      Note

      By default, Layer 7 listeners of CLB use the X-Forwarded-For header to preserve client IP addresses. The header cannot be disabled. If more than one IP address is preserved, the first one is the client IP address. For detailed configuration, see Enable Layer 7 listeners to preserve client IP addresses.

    • SLB-ID: Retrieve SLB ID: obtains the ID of the CLB instance.

    • SLB-IP: Retrieve SLB IP: obtains the IP address of the CLB instance.

    • X-Forwarded-Proto: Retrieve Listener Protocol: obtains the listener protocol.

    Client IP Address Preservation

    Specify whether to obtain client IP addresses. By default, this feature is enabled.

    Automatically Enable Listener

    Specify whether to immediately enable the listener after it is created. By default, listeners are enabled after they are created.

Step 2: Configure an SSL certificate

  1. In the Certificate Management Service step, select an uploaded server certificate or click Create Server Certificate to upload a server certificate. You can also purchase a certificate. For more information about certificates, see Add a certificate.

  2. (Optional) Click Modify next to Advanced Settings to enable mutual authentication or configure TLS security policies.

    1. Turn on Mutual Authentication and select an uploaded CA certificate or create a CA certificate. For more information, see Purchase and enable a private CA.

    2. Configure the TLS Security Policy parameter.

    Note
    • TLS security policies are supported only by high-performance CLB instances.

    • A TLS security policy contains TLS protocol versions and cipher suites that are available for HTTPS. For more information, see TLS security policies.

Step 3: Add backend servers

After the listener is created, you must add backend servers to process client requests. You can use the default server group that is configured for the CLB instance. You can also create a vServer group. For more information, see CLB server groups.

Important

HTTPS listeners do not support primary/secondary server groups.

  1. In the Backend Servers step, select Default Server Group and click Add More.

  2. In the Servers step, select the backend servers that you want to add and click Next.

  3. In the Ports/Weights step, configure the weights of the backend servers.

    Note
    • The default weight is 100. Backend servers with a higher weight receive more requests.

    • If the weight of a backend server is set to 0, no request is distributed to the backend server.

  4. Click Add. Specify the port that is used by the backend server to receive requests. Valid values: 1 to 65535.

    Note

    You can specify the same port for backend servers that are added to the same CLB instance.

Step 4: Configure health checks

CLB checks the availability of backend servers by performing health checks. The health check feature improves overall service availability and reduces the impact of backend server failures.

Note

You cannot disable health checks for a listener that is associated with a primary/secondary server group.

  1. Optional: In the Health Check step, click Modify to modify the health check configuration and click Next. For more information, see Configure and manage CLB health checks.

  2. In the Confirm step, check the configurations of the listener. You can click Modify to modify the configurations.

  3. Confirm the configurations and click Submit. In the Configuration Successful message, click OK.

    After you configure the listener, you can view the listener on the Listener tab.

FAQs

Does CLB support the configuration of HTTPS listeners to achieve end-to-end HTTPS access?

No. When you configure an HTTP listener, the backend protocol supports only HTTP. Therefore, when CLB receives an HTTPS request from the client, it first decrypts the request and forwards the decrypted data to the backend server in the form of HTTP protocol. This approach simplifies the configuration of the backend server and reduces the performance overhead associated with the HTTPS TLS handshake.

You can use one of the following methods to enable end-to-end HTTPS access for your business:

  • Create an Application Load Balancer (ALB) instance and configure an HTTPS listener for this instance. For more information, see Configure end-to-end HTTPS encryption for data transfers.

  • Configure a TCP listener for a CLB instance, and associate an SSL certificate with the corresponding backend servers.

Which port do HTTPS listeners use?

HTTPS listeners have no special requirements for ports. However, we recommend that you specify port 443 for HTTPS listeners.

What types of certificates does CLB support?

CLB supports server certificates and CA certificates in PEM format.

For the server certificates, you must upload both the certificate content and the private key. For the CA certificates, you need to upload only the certificate content.

Does CLB support keytool-created certificates?

Yes.

You must convert the certificate format to PEM before you upload the certificates to CLB. For more information, see Convert certificate formats.

Can I use certificates in the PKCS#12 (PFX) format?

Yes.

You must convert the certificate format to PEM before you upload the certificates to CLB. For more information, see Convert certificate formats.

Why does the KeyEncryption error arise when I upload certificates?

The error arises because the private key contains incorrect content. For more information, see Certificate requirements and certificate format conversion.

What SSL protocol versions are supported by HTTPS listeners?

HTTPS listeners support the following SSL protocol versions: TLSv1.0, TLSv1.1, TLSv1.2, and TLSv1.3.

What is the TTL of an HTTPS session ticket?

The TTL of an HTTPS session ticket is 300 seconds.

Can I upload a certificate that contains the DH PARAMETERS field?

The ECDHE cipher suites used by HTTPS listeners support forward secrecy but do not support the security enhancement parameters required by DHE cipher suites. As a result, strings that contain the BEGIN DH PARAMETERS field in a PEM certificate file cannot be uploaded.

Do HTTPS listeners support SNI?

Server Name Indication (SNI) is an extension to SSL and TLS and allows a server to install multiple SSL certificates on the same IP address. For more information, see Add and manage additional domain names.

References

  • On this page (1)
  • Prerequisites
  • Limits
  • Usage notes
  • Procedure
  • Step 1: Add an HTTPS listener
  • Step 2: Configure an SSL certificate
  • Step 3: Add backend servers
  • Step 4: Configure health checks
  • FAQs
  • Does CLB support the configuration of HTTPS listeners to achieve end-to-end HTTPS access?
  • Which port do HTTPS listeners use?
  • What types of certificates does CLB support?
  • Does CLB support keytool-created certificates?
  • Can I use certificates in the PKCS#12 (PFX) format?
  • Why does the KeyEncryption error arise when I upload certificates?
  • What SSL protocol versions are supported by HTTPS listeners?
  • What is the TTL of an HTTPS session ticket?
  • Can I upload a certificate that contains the DH PARAMETERS field?
  • Do HTTPS listeners support SNI?
  • References
Feedback