How to get and deploy an SSL certificate on Alibaba Cloud

Alibaba Cloud Certificate Management Service issues a certificate after you submit the application and validate the domain by DNS record or file. You then download it for your own Nginx server, or deploy it to an Alibaba Cloud service such as CDN or Application Load Balancer (ALB).

Steps and screen names follow the international site (alibabacloud.com) documentation as of November 2026. The China site (aliyun.com) has its own free-certificate rules, so screenshots and answers written for Chinese users do not always match what you see.

Free or paid: what the international site offers

Plan on a paid certificate, or on Let's Encrypt, when you use the international console. Alibaba Cloud's own API reference lists the free three-month DigiCert single-domain product as available only on the China site, and the international billing pages do not list a free certificate. Some international pages still mention a "personal test certificate"; where it appears, Alibaba Cloud describes it as a DV certificate for one domain name, valid 90 days, renewed by hand, and intended for test environments rather than production.

Other things that changed recently:

• The product is called Certificate Management Service. SSL certificates live under Certificate Management → SSL Certificate Management V2.0. V1.0 no longer accepts new purchases, and Alibaba Cloud says the migration to V2.0 was complete on February 14, 2026. Purchased certificates appear on the Commercial Certificates tab.
• Alibaba Cloud adjusted the validity of commercial certificates from February 25, 2026 to follow the CA/Browser Forum schedule: 200 days for certificates issued since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. A "one-year" purchase therefore means more than one issuance.

If you need a wildcard, or renewal without any manual step, a free Let's Encrypt certificate issued with acme.sh and the Alibaba Cloud DNS API is usually simpler than anything in the console.

Prerequisites

You need a purchased certificate, the domain, and access to its DNS records or document root.

• An Alibaba Cloud international account with access to Certificate Management Service and a purchased certificate (or a free quota, if your account shows one).
• The domain, for example www.example.com, and access to its DNS records or to the website's document root.
• If the website will be served from the Chinese mainland, an ICP filing for the domain. Every website hosted in the mainland needs one, and Alibaba Cloud CDN requires an ICP number when the acceleration region is Chinese Mainland Only or Global. Servers and CDN regions outside the mainland, including Global (Excluding the Chinese Mainland), need no filing.
• For one-click deployment, a RAM user with the AliyunYundunCertFullAccess policy.

Step 1: Fill in the certificate application

Open the Certificate Management Service console, go to SSL Certificate Management V2.0 → Commercial Certificates, and start the application for the certificate you bought. Enter the domain name the way visitors type it (www.example.com, or *.example.com for a wildcard product), plus the contact details the CA requires.

For the key pair, letting the console generate the CSR is the least work. If your policy requires that the private key never leaves your server, create the CSR yourself with OpenSSL or the CSR generator and paste it in instead; you then keep the .key file and only download the certificate later.

Step 2: Validate the domain

A DV certificate is validated by DNS record or by file, and the console offers three methods:

• Automatic DNS Verification: used when the domain is hosted on Alibaba Cloud DNS. The console adds the record for you, and you cannot switch to another method.
• Manual DNS Verification: you add the record shown in the console at your DNS provider. This works for any provider and for wildcards.
• File Verification: you download a file and publish it under /.well-known/pki-validation/ on the site, for example https://www.example.com/.well-known/pki-validation/<file>.txt. It is not available for wildcard domains.

Before clicking Verify, confirm the record or file is publicly visible. Use the exact record name and file name the console shows:

dig +short TXT <record-name-from-console>.example.com
curl -s http://www.example.com/.well-known/pki-validation/<file>.txt

A common mistake is typing the full domain into the host field of a DNS provider that appends the zone automatically, which produces ...example.com.example.com. After validation the CA issues the certificate, usually within minutes for DV.

Step 3: Download and install on Nginx

On the Commercial Certificates tab, click Download for the issued certificate and pick the server type. NGINX gives a PEM bundle: <domain>.pem (certificate and chain) and <domain>.key (private key). The other choices are Apache (_public.crt, _chain.crt and .key), Tomcat and IIS (PFX), JKS, and Other (PEM).

Copy the archive to the server and install it:

sudo mkdir -p /etc/nginx/ssl
sudo unzip www.example.com_nginx.zip -d /etc/nginx/ssl/
sudo chmod 600 /etc/nginx/ssl/*.key
ls /etc/nginx/ssl/

File names follow your download. Reference them in Nginx:

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/nginx/ssl/www.example.com.pem;
    ssl_certificate_key /etc/nginx/ssl/www.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
}

sudo nginx -t && sudo systemctl reload nginx

If you use BT Panel or aaPanel, paste the .key and .pem contents into the site's SSL page instead; see BT Panel SSL.

Step 4 (optional): Deploy to Alibaba Cloud services

For Alibaba Cloud services you do not need to download anything. In the certificate list, click Deploy in the Actions column, choose the resource under Select Resource, and confirm with Preview and Submit. For many resources at once, use Deployment Management → Deployment to Cloud Services → Create Task.

CDN and DCDN accept both a first deployment and later updates. ALB, NLB, OSS, WAF, Edge Security Acceleration (ESA) and the other listed services can only update a certificate that is already configured on them, so set HTTPS up once in that product's console. CDN specifics are in Alibaba Cloud CDN HTTPS.

Verify

A correct install shows a complete chain and the expiry date listed in the console. Check the public endpoint with the SSL checker, or from any terminal:

curl ssl.sh/www.example.com

If Nginx refuses to start, confirm the key belongs to the certificate with the key matcher.

Renewal

Nothing in Certificate Management Service renews a certificate on your server for you. Each new issuance means validating again, downloading again and replacing the files, or deploying again to the cloud service. With the 200-day cap now and 47 days from March 15, 2029, that manual loop becomes the weak point. These options remove the manual steps:

• On your own servers, switch to acme.sh with the Alibaba Cloud DNS API, which issues and renews Let's Encrypt certificates without manual steps.
• For CDN, let acme.sh push each renewed certificate with its ali_cdn deploy hook, described in Alibaba Cloud CDN HTTPS.
• Add every domain to ssl.sh monitoring (in development) so an expiry warning reaches you even if a step was skipped. Read preparing for 47-day certificates for the wider plan.

Troubleshooting

• Validation never completes: the DNS host field contains the zone twice, the record has not propagated, or the validation file is redirected, blocked by hotlink protection, or served on the wrong virtual host.
• CAA record prevents issuance: the domain's CAA records do not allow the CA that issues your product; see CAA record prevents issuance.
• Nginx reports key values mismatch: the key and certificate come from different applications; see nginx key values mismatch.
• Phones or apps say the certificate is not trusted: the server sends only the leaf certificate; see missing intermediate certificate.
• Browsers say the certificate expired: it was not replaced in time; see NET::ERR_CERT_DATE_INVALID.