How to configure HTTPS on Alibaba Cloud CDN

Alibaba Cloud CDN serves HTTPS once you switch on HTTPS Secure Acceleration for the domain and attach a certificate from Certificate Management Service or a pasted PEM certificate and key. The HTTP-to-HTTPS redirect, HSTS, TLS versions and the origin protocol are separate settings.

Menu names follow the international site (alibabacloud.com) CDN documentation as of November 2026. The example domain is cdn.example.com.

Prerequisites

The CDN domain must already work over HTTP.

• The accelerated domain added in the CDN console, its CNAME pointing at the address Alibaba Cloud assigned, and HTTP requests working.
• If the acceleration region is Chinese Mainland Only or Global, an ICP filing for the domain. With Global (Excluding the Chinese Mainland) no filing is needed; Alibaba Cloud then serves visitors in the mainland from points of presence in Japan, Singapore or Hong Kong. After an ICP number is granted, Alibaba Cloud recommends waiting about eight hours before adding the domain.
• A certificate that covers the domain: one from Certificate Management Service (see Alibaba Cloud SSL certificate), or your own PEM certificate and key, for example from acme.sh.
• Pages that do not hard-code http:// resources.

Step 1: Open the HTTPS settings

In the CDN console go to Domain Names, click Manage next to the domain, and open HTTPS. In the HTTPS Certificate section click Modify and switch on HTTPS Secure Acceleration.

Step 2: Choose the certificate source

The certificate comes either from Certificate Management Service or from a PEM certificate and key that you paste in.

• Certificate Management Service: pick the certificate from the Certificate Name list. Its domain must match the accelerated domain (a wildcard covers one level of subdomain).
• Custom Certificate (Certificate+Private Key): enter a name, then paste the PEM certificate into Certificate (Public Key) and the PEM key into Private Key. Paste the full chain, leaf first and intermediates after it. The key must not be password-protected, and only PEM is accepted; convert other formats with the SSL converter.

Submit, and the change reaches the CDN nodes within minutes.

Step 3: Redirect, HSTS, TLS versions and HTTP/2

Turn on the HTTP-to-HTTPS redirect and HTTP/2, disable TLS 1.0 and 1.1, and add HSTS last. Each is a separate section on the same HTTPS page.

• HTTP/S Redirect: click Modify and set Redirect Type to HTTP -> HTTPS. The redirect uses status 301. Never combine HTTPS -> HTTP with HSTS.
• HSTS: switch it on only after every page works over HTTPS. Set Expire In (in days) to something short at first, and enable Include Subdomains only if every subdomain has HTTPS. Read enable HSTS before raising the value.
• TLS Cipher Suite and Version: TLSv1.0, TLSv1.1, TLSv1.2 and TLSv1.3 are all enabled by default. Turn off 1.0 and 1.1 unless you must support old clients. TLS 1.3 is now specified in RFC 9846, published in July 2026.
• HTTP/2: switch it on. It requires the certificate, and turning HTTPS off later disables it again.

Step 4: Encrypt the CDN-to-origin connection

Open Origin Fetch, switch on Origin Protocol Policy, and choose HTTPS (always fetch over HTTPS) or Follow (use the visitor's protocol). With the policy off, Alibaba Cloud fetches over HTTPS only when the origin port is 443, and over HTTP otherwise.

For HTTPS fetching, the origin needs a valid certificate on port 443 for the host name the CDN sends (the Default Origin Host, or the origin SNI setting if you set one). If you keep HTTP fetching, remove any HTTP-to-HTTPS redirect on the origin, otherwise requests loop.

Verify

A working setup shows the certificate you configured, a 301 for http:// and, once enabled, the HSTS header. Check the CDN domain with the SSL checker, or from any terminal:

curl ssl.sh/cdn.example.com
curl -sI http://cdn.example.com | grep -iE '^(HTTP|location)'
curl -sI https://cdn.example.com | grep -i strict-transport-security

The HSTS checker also shows the header. To confirm old protocols are off:

openssl s_client -connect cdn.example.com:443 -servername cdn.example.com -tls1_1 </dev/null

The handshake should fail.

Automatic renewal

The CDN does not renew a custom certificate for you. Keep it current in one of two ways:

• If the certificate comes from Certificate Management Service, deploy each new issuance to the CDN domain from that console (Deploy in the certificate list, or a deployment task).
• If the certificate comes from acme.sh, use its ali_cdn deploy hook. It reuses the Ali_Key and Ali_Secret variables of the DNS hook and pushes the certificate after every renewal:

export Ali_Key="your-access-key-id"
export Ali_Secret="your-access-key-secret"
export DEPLOY_ALI_CDN_DOMAIN="cdn.example.com"
acme.sh --deploy -d example.com --deploy-hook ali_cdn

DEPLOY_ALI_CDN_DOMAIN accepts several space-separated domains, and a leading dot (.example.com) targets wildcard accelerated domains. For DCDN use ali_dcdn and DEPLOY_ALI_DCDN_DOMAIN. acme.sh remembers the hook, so later renewals deploy on their own. The RAM user behind the AccessKey needs permission to set CDN certificates.

Public certificates last at most 200 days since March 15, 2026 and 100 days from March 15, 2027, so a manual upload will eventually be forgotten. Automate it, and add the domain to ssl.sh monitoring (in development).

Troubleshooting

• Certificate and private key do not match: the key belongs to another certificate; check with the key matcher and see nginx key values mismatch.
• Some phones or mini programs report an incomplete chain: only the leaf certificate was pasted; add the intermediate, see missing intermediate certificate.
• Too many redirects: both the origin and the CDN redirect; see the FAQ and redirect HTTP to HTTPS.
• Visitors see an expired certificate: a custom certificate was not replaced; see NET::ERR_CERT_DATE_INVALID.
• Padlock missing although HTTPS works: the page loads HTTP resources; see mixed content warning.