# Alibaba Cloud SSL certificate: request, validate, install > Get a certificate from Alibaba Cloud Certificate Management Service, validate it by DNS or file, install it on Nginx or deploy it to CDN and ALB. Source: https://ssl.sh/guides/aliyun-ssl-certificate/ Last updated: 2026-11-10 Alibaba Cloud Certificate Management Service issues a certificate after you submit the application and validate the domain by DNS record or file. You then download it for your own Nginx server, or deploy it to an Alibaba Cloud service such as CDN or Application Load Balancer (ALB). Steps and screen names follow the international site (alibabacloud.com) documentation as of November 2026. The China site (aliyun.com) has its own free-certificate rules, so screenshots and answers written for Chinese users do not always match what you see. ## Free or paid: what the international site offers Plan on a paid certificate, or on Let's Encrypt, when you use the international console. Alibaba Cloud's own API reference lists the free three-month DigiCert single-domain product as available only on the China site, and the international billing pages do not list a free certificate. Some international pages still mention a "personal test certificate"; where it appears, Alibaba Cloud describes it as a DV certificate for one domain name, valid 90 days, renewed by hand, and intended for test environments rather than production. Other things that changed recently: - The product is called **Certificate Management Service**. SSL certificates live under **Certificate Management → SSL Certificate Management V2.0**. V1.0 no longer accepts new purchases, and Alibaba Cloud says the migration to V2.0 was complete on February 14, 2026. Purchased certificates appear on the **Commercial Certificates** tab. - Alibaba Cloud adjusted the validity of commercial certificates from February 25, 2026 to follow the CA/Browser Forum schedule: 200 days for certificates issued since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. A "one-year" purchase therefore means more than one issuance. If you need a wildcard, or renewal without any manual step, a free Let's Encrypt certificate issued with [acme.sh and the Alibaba Cloud DNS API](https://ssl.sh/guides/acme-sh-dnspod-aliyun-dns/) is usually simpler than anything in the console. ## Prerequisites You need a purchased certificate, the domain, and access to its DNS records or document root. - An Alibaba Cloud international account with access to Certificate Management Service and a purchased certificate (or a free quota, if your account shows one). - The domain, for example `www.example.com`, and access to its DNS records or to the website's document root. - If the website will be served from the Chinese mainland, an ICP filing for the domain. Every website hosted in the mainland needs one, and Alibaba Cloud CDN requires an ICP number when the acceleration region is **Chinese Mainland Only** or **Global**. Servers and CDN regions outside the mainland, including **Global (Excluding the Chinese Mainland)**, need no filing. - For one-click deployment, a RAM user with the `AliyunYundunCertFullAccess` policy. ## Step 1: Fill in the certificate application Open the Certificate Management Service console, go to **SSL Certificate Management V2.0 → Commercial Certificates**, and start the application for the certificate you bought. Enter the domain name the way visitors type it (`www.example.com`, or `*.example.com` for a wildcard product), plus the contact details the CA requires. For the key pair, letting the console generate the CSR is the least work. If your policy requires that the private key never leaves your server, create the CSR yourself with [OpenSSL](https://ssl.sh/guides/generate-csr-openssl/) or the [CSR generator](https://ssl.sh/tools/csr-generator/) and paste it in instead; you then keep the `.key` file and only download the certificate later. ## Step 2: Validate the domain A DV certificate is validated by DNS record or by file, and the console offers three methods: - **Automatic DNS Verification**: used when the domain is hosted on Alibaba Cloud DNS. The console adds the record for you, and you cannot switch to another method. - **Manual DNS Verification**: you add the record shown in the console at your DNS provider. This works for any provider and for wildcards. - **File Verification**: you download a file and publish it under `/.well-known/pki-validation/` on the site, for example `https://www.example.com/.well-known/pki-validation/.txt`. It is not available for wildcard domains. Before clicking **Verify**, confirm the record or file is publicly visible. Use the exact record name and file name the console shows: ```bash dig +short TXT .example.com curl -s http://www.example.com/.well-known/pki-validation/.txt ``` A common mistake is typing the full domain into the host field of a DNS provider that appends the zone automatically, which produces `...example.com.example.com`. After validation the CA issues the certificate, usually within minutes for DV. ## Step 3: Download and install on Nginx On the **Commercial Certificates** tab, click **Download** for the issued certificate and pick the server type. **NGINX** gives a PEM bundle: `.pem` (certificate and chain) and `.key` (private key). The other choices are Apache (`_public.crt`, `_chain.crt` and `.key`), Tomcat and IIS (PFX), JKS, and Other (PEM). Copy the archive to the server and install it: ```bash sudo mkdir -p /etc/nginx/ssl sudo unzip www.example.com_nginx.zip -d /etc/nginx/ssl/ sudo chmod 600 /etc/nginx/ssl/*.key ls /etc/nginx/ssl/ ``` File names follow your download. Reference them in Nginx: ```nginx server { listen 443 ssl; server_name www.example.com; ssl_certificate /etc/nginx/ssl/www.example.com.pem; ssl_certificate_key /etc/nginx/ssl/www.example.com.key; ssl_protocols TLSv1.2 TLSv1.3; } ``` ```bash sudo nginx -t && sudo systemctl reload nginx ``` If you use BT Panel or aaPanel, paste the `.key` and `.pem` contents into the site's SSL page instead; see [BT Panel SSL](https://ssl.sh/guides/bt-panel-ssl/). ## Step 4 (optional): Deploy to Alibaba Cloud services For Alibaba Cloud services you do not need to download anything. In the certificate list, click **Deploy** in the **Actions** column, choose the resource under **Select Resource**, and confirm with **Preview and Submit**. For many resources at once, use **Deployment Management → Deployment to Cloud Services → Create Task**. CDN and DCDN accept both a first deployment and later updates. ALB, NLB, OSS, WAF, Edge Security Acceleration (ESA) and the other listed services can only update a certificate that is already configured on them, so set HTTPS up once in that product's console. CDN specifics are in [Alibaba Cloud CDN HTTPS](https://ssl.sh/guides/aliyun-cdn-https/). ## Verify A correct install shows a complete chain and the expiry date listed in the console. Check the public endpoint with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal: ```bash curl ssl.sh/www.example.com ``` If Nginx refuses to start, confirm the key belongs to the certificate with the [key matcher](https://ssl.sh/tools/key-matcher/). ## Renewal Nothing in Certificate Management Service renews a certificate on your server for you. Each new issuance means validating again, downloading again and replacing the files, or deploying again to the cloud service. With the 200-day cap now and 47 days from March 15, 2029, that manual loop becomes the weak point. These options remove the manual steps: - On your own servers, switch to [acme.sh with the Alibaba Cloud DNS API](https://ssl.sh/guides/acme-sh-dnspod-aliyun-dns/), which issues and renews Let's Encrypt certificates without manual steps. - For CDN, let acme.sh push each renewed certificate with its `ali_cdn` deploy hook, described in [Alibaba Cloud CDN HTTPS](https://ssl.sh/guides/aliyun-cdn-https/). - Add every domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) so an expiry warning reaches you even if a step was skipped. Read [preparing for 47-day certificates](https://ssl.sh/guides/prepare-for-47-day-certificates/) for the wider plan. ## Troubleshooting - **Validation never completes**: the DNS host field contains the zone twice, the record has not propagated, or the validation file is redirected, blocked by hotlink protection, or served on the wrong virtual host. - **CAA record prevents issuance**: the domain's CAA records do not allow the CA that issues your product; see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). - **Nginx reports key values mismatch**: the key and certificate come from different applications; see [nginx key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/). - **Phones or apps say the certificate is not trusted**: the server sends only the leaf certificate; see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/). - **Browsers say the certificate expired**: it was not replaced in time; see [NET::ERR_CERT_DATE_INVALID](https://ssl.sh/errors/net-err-cert-date-invalid/).