Certificate Management Service provides a comprehensive solution to manage SSL certificates throughout their entire lifecycles, including certificate purchase, application, deployment, hosting, and renewal.
Flowchart

Procedure
Purchase
You must purchase a certificate before you can use a certificate. You can purchase a certificate by binding a domain name or purchasing a quota for SSL certificates. When you purchase a certificate, you must select a reliable certificate authority (CA), such as DigiCert, GlobalSign, or GeoTrust. CAs provide various types of certificates, including single-domain, wildcard, and multi-domain certificates. You must select a certificate type that best suits the business and security requirements of your website. For more information about how to purchase a quota for SSL certificates, see Purchase a quota for SSL certificates.
Application
After you purchase a quota for SSL certificates, you can create a certificate, apply for the certificate, and perform domain name ownership verification. You need to generate a Certificate Signing Request (CSR) file that contains the domain name and company name of your website. After a CSR file is generated, you must submit it to the CA for review and verification. The following types of certificates are supported: domain validated (DV), organization validated (OV), and extended validation (EV). The security levels and costs of the certificates vary. For more information about how to apply for a certificate, see Create a certificate, Apply for a certificate, and Step 3: Verify the ownership of a domain name.
Deployment
After a certificate is issued, you can deploy it to the server of your website to ensure HTTPS access to the website. Supported servers include Apache, NGINX, and IIS servers. The deployment process varies based on the server type and the hosting environment. When you deploy a certificate, you must also redirect HTTP requests to HTTPS and make sure that no vulnerabilities exist in the related configuration files. For more information, see Installation overview.
Renewal
When a certificate is about to expire, you can renew the certificate to obtain a new certificate and install the new certificate on the server of your website to ensure continuous encryption and security for your website. In most cases, a certificate is valid for up to 395 days, approximately 13 months. If you do not renew a certificate after it expires, security issues may occur and security alerts may be generated on browsers. This further compromises user trust and access experience. For more information about how to renew a certificate, see Renew an official SSL certificate.
Revocation
If you no longer want to use a certificate due to security or other reasons, you can revoke the certificate. After a certificate is revoked from the CA, you can no longer use the certificate for secure communications. For more information about how to revoke a certificate, see Revoke and delete a certificate.