# Alibaba Cloud CDN HTTPS: certificate, redirect, HSTS, origin

> Turn on HTTPS for an Alibaba Cloud CDN domain: pick a certificate, force HTTPS, set HSTS and TLS versions, and choose the origin protocol policy.

Source: https://ssl.sh/guides/aliyun-cdn-https/
Last updated: 2026-11-10

Alibaba Cloud CDN serves HTTPS once you switch on **HTTPS Secure Acceleration** for the domain and attach a certificate from Certificate Management Service or a pasted PEM certificate and key. The HTTP-to-HTTPS redirect, HSTS, TLS versions and the origin protocol are separate settings.

Menu names follow the international site (alibabacloud.com) CDN documentation as of November 2026. The example domain is `cdn.example.com`.

## Prerequisites

The CDN domain must already work over HTTP.

- The accelerated domain added in the CDN console, its CNAME pointing at the address Alibaba Cloud assigned, and HTTP requests working.
- If the acceleration region is **Chinese Mainland Only** or **Global**, an ICP filing for the domain. With **Global (Excluding the Chinese Mainland)** no filing is needed; Alibaba Cloud then serves visitors in the mainland from points of presence in Japan, Singapore or Hong Kong. After an ICP number is granted, Alibaba Cloud recommends waiting about eight hours before adding the domain.
- A certificate that covers the domain: one from Certificate Management Service (see [Alibaba Cloud SSL certificate](https://ssl.sh/guides/aliyun-ssl-certificate/)), or your own PEM certificate and key, for example from [acme.sh](https://ssl.sh/guides/acme-sh-dnspod-aliyun-dns/).
- Pages that do not hard-code `http://` resources.

## Step 1: Open the HTTPS settings

In the CDN console go to **Domain Names**, click **Manage** next to the domain, and open **HTTPS**. In the **HTTPS Certificate** section click **Modify** and switch on **HTTPS Secure Acceleration**.

## Step 2: Choose the certificate source

The certificate comes either from Certificate Management Service or from a PEM certificate and key that you paste in.

- **Certificate Management Service**: pick the certificate from the **Certificate Name** list. Its domain must match the accelerated domain (a wildcard covers one level of subdomain).
- **Custom Certificate (Certificate+Private Key)**: enter a name, then paste the PEM certificate into **Certificate (Public Key)** and the PEM key into **Private Key**. Paste the full chain, leaf first and intermediates after it. The key must not be password-protected, and only PEM is accepted; convert other formats with the [SSL converter](https://ssl.sh/tools/ssl-converter/).

Submit, and the change reaches the CDN nodes within minutes.

## Step 3: Redirect, HSTS, TLS versions and HTTP/2

Turn on the HTTP-to-HTTPS redirect and HTTP/2, disable TLS 1.0 and 1.1, and add HSTS last. Each is a separate section on the same **HTTPS** page.

- **HTTP/S Redirect**: click **Modify** and set **Redirect Type** to **HTTP -> HTTPS**. The redirect uses status 301. Never combine **HTTPS -> HTTP** with HSTS.
- **HSTS**: switch it on only after every page works over HTTPS. Set **Expire In** (in days) to something short at first, and enable **Include Subdomains** only if every subdomain has HTTPS. Read [enable HSTS](https://ssl.sh/guides/enable-hsts/) before raising the value.
- **TLS Cipher Suite and Version**: TLSv1.0, TLSv1.1, TLSv1.2 and TLSv1.3 are all enabled by default. Turn off 1.0 and 1.1 unless you must support old clients. TLS 1.3 is now specified in RFC 9846, published in July 2026.
- **HTTP/2**: switch it on. It requires the certificate, and turning HTTPS off later disables it again.

## Step 4: Encrypt the CDN-to-origin connection

Open **Origin Fetch**, switch on **Origin Protocol Policy**, and choose **HTTPS** (always fetch over HTTPS) or **Follow** (use the visitor's protocol). With the policy off, Alibaba Cloud fetches over HTTPS only when the origin port is 443, and over HTTP otherwise.

For HTTPS fetching, the origin needs a valid certificate on port 443 for the host name the CDN sends (the **Default Origin Host**, or the origin SNI setting if you set one). If you keep HTTP fetching, remove any HTTP-to-HTTPS redirect on the origin, otherwise requests loop.

## Verify

A working setup shows the certificate you configured, a 301 for `http://` and, once enabled, the HSTS header. Check the CDN domain with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal:

```bash
curl ssl.sh/cdn.example.com
curl -sI http://cdn.example.com | grep -iE '^(HTTP|location)'
curl -sI https://cdn.example.com | grep -i strict-transport-security
```

The [HSTS checker](https://ssl.sh/tools/hsts-checker/) also shows the header. To confirm old protocols are off:

```bash
openssl s_client -connect cdn.example.com:443 -servername cdn.example.com -tls1_1 </dev/null
```

The handshake should fail.

## Automatic renewal

The CDN does not renew a custom certificate for you. Keep it current in one of two ways:

- If the certificate comes from Certificate Management Service, deploy each new issuance to the CDN domain from that console (**Deploy** in the certificate list, or a deployment task).
- If the certificate comes from acme.sh, use its `ali_cdn` deploy hook. It reuses the `Ali_Key` and `Ali_Secret` variables of the DNS hook and pushes the certificate after every renewal:

```bash
export Ali_Key="your-access-key-id"
export Ali_Secret="your-access-key-secret"
export DEPLOY_ALI_CDN_DOMAIN="cdn.example.com"
acme.sh --deploy -d example.com --deploy-hook ali_cdn
```

`DEPLOY_ALI_CDN_DOMAIN` accepts several space-separated domains, and a leading dot (`.example.com`) targets wildcard accelerated domains. For DCDN use `ali_dcdn` and `DEPLOY_ALI_DCDN_DOMAIN`. acme.sh remembers the hook, so later renewals deploy on their own. The RAM user behind the AccessKey needs permission to set CDN certificates.

Public certificates last at most 200 days since March 15, 2026 and 100 days from March 15, 2027, so a manual upload will eventually be forgotten. Automate it, and add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).

## Troubleshooting

- **Certificate and private key do not match**: the key belongs to another certificate; check with the [key matcher](https://ssl.sh/tools/key-matcher/) and see [nginx key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/).
- **Some phones or mini programs report an incomplete chain**: only the leaf certificate was pasted; add the intermediate, see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/).
- **Too many redirects**: both the origin and the CDN redirect; see the FAQ and [redirect HTTP to HTTPS](https://ssl.sh/guides/redirect-http-to-https/).
- **Visitors see an expired certificate**: a custom certificate was not replaced; see [NET::ERR_CERT_DATE_INVALID](https://ssl.sh/errors/net-err-cert-date-invalid/).
- **Padlock missing although HTTPS works**: the page loads HTTP resources; see [mixed content warning](https://ssl.sh/errors/mixed-content-warning/).