# Tencent Cloud CDN HTTPS: certificate, origin-pull and HSTS > Configure HTTPS on Tencent Cloud CDN: hosted or own certificate, origin-pull protocol, forced redirection, HSTS, TLS versions and HTTP/2. Source: https://ssl.sh/guides/tencent-cloud-cdn-https/ Last updated: 2026-11-10 A Tencent Cloud CDN domain such as `cdn.example.com` serves HTTPS once you attach a certificate on its **HTTPS Configuration** tab and choose the origin-pull protocol. Forced redirection, HSTS and TLS versions are switches on the same tab. Renewed certificates must reach the CDN through SSL Certificate Service or an upload, because the CDN never renews one itself. Menu names follow the Tencent Cloud International CDN documentation as of November 2026; parts of those pages are machine-translated, so labels in your console may read slightly differently. ## Prerequisites The CDN domain must already work over HTTP. - The domain added to Tencent Cloud CDN, its CNAME pointing at the CDN, and HTTP requests working. - If the acceleration region is the Chinese mainland or global, an ICP filing for the domain from China's Ministry of Industry and Information Technology (MIIT). Tencent Cloud states that domains running in the Chinese mainland require one. - A certificate covering the domain: one in SSL Certificate Service (see [Tencent Cloud SSL certificate](https://ssl.sh/guides/tencent-cloud-ssl-certificate/)), or your own PEM certificate and key, for example from [acme.sh](https://ssl.sh/guides/acme-sh-dnspod-aliyun-dns/). - Pages without hard-coded `http://` resources. ## Step 1: Open HTTPS Configuration In the CDN console go to **Domain Management**, click **Manage** next to the domain, and open the **HTTPS Configuration** tab. Start the certificate configuration from the HTTPS section. Certificates for several domains can also be managed from **Certificate Management → Configure Certificate** in the left sidebar. ## Step 2: Choose the certificate The certificate comes either from SSL Certificate Service or from your own PEM files: - **Tencent Cloud hosted certificate**: pick an issued or uploaded certificate from SSL Certificate Service. - **Your own certificate**: paste the full chain in PEM (leaf first, then intermediates) and the PEM private key. A key that belongs to a different certificate is rejected; check with the [key matcher](https://ssl.sh/tools/key-matcher/) first. Alternatively, start from the certificate side: in SSL Certificate Service open **Certificate Details → Quick Deployment**, choose CDN and select the domains. ## Step 3: Choose the origin-pull protocol The origin-pull protocol decides whether the CDN-to-origin leg is encrypted. It lives on the **Basic Configuration** tab under **Origin Server Information → Origin-pull protocol**, and the certificate deployment flow asks for it too: - **HTTP**: the origin needs no certificate, but the CDN-to-origin leg is unencrypted, and the origin must not redirect HTTP to HTTPS. - **HTTPS**: always fetch over HTTPS. - **Follow Protocol**: use the same protocol as the visitor. Recommended with a valid origin certificate. For HTTPS or Follow Protocol, the origin must answer HTTPS on port 443 (configuration fails with another port) with a certificate that covers the origin host. COS and FTP origins only support HTTP origin-pull. HTTP/2 is not used towards the origin. ## Step 4: Forced redirection, HSTS, TLS and HTTP/2 The remaining HTTPS options are separate sections on the **HTTPS Configuration** tab: - **Forced Redirection Configuration**: off by default. Switch it on, choose HTTP to HTTPS, and pick 301 as the method (302 is also available). - **HSTS Configuration**: off by default. Enable it only after the whole site works over HTTPS, with a short `expireTime` at first, and set `includeSubDomain` only if every subdomain has HTTPS. Read [enable HSTS](https://ssl.sh/guides/enable-hsts/) first. - **TLS Version Configuration**: by default TLS 1.0, 1.1 and 1.2 are on and TLS 1.3 is off. Select a consecutive range, typically 1.2 and 1.3. Tencent Cloud documents this setting for Chinese mainland nodes; for a domain accelerated globally, the change applies only in the mainland. - **HTTP2.0 Configuration**: on by default once a certificate is configured; deleting the certificate turns it off. - **OCSP Stapling Configuration**: useful only for certificates whose CA runs OCSP (see the FAQ). Changes reach the edge nodes within minutes. ## Verify The issuer and expiry should match your certificate, `http://` should return 301, and the HSTS header should appear once enabled. Check the domain with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal: ```bash curl ssl.sh/cdn.example.com curl -sI http://cdn.example.com | grep -iE '^(HTTP|location)' curl -sI https://cdn.example.com | grep -i strict-transport-security ``` The [HSTS checker](https://ssl.sh/tools/hsts-checker/) also shows the header. Confirm the protocol range: ```bash openssl s_client -connect cdn.example.com:443 -servername cdn.example.com -tls1_3 /dev/null | grep -E 'Protocol|Cipher' ``` ## Automatic renewal The CDN itself never renews a certificate. Handle renewal by source: - **Hosted certificate**: after it is renewed or replaced in SSL Certificate Service, let **Certificate Hosting** update the associated CDN domains (check the console for conditions and charges). Free certificates last 3 months and are not auto-renewed, so this still needs a new application each time. - **Your own certificate**: upload the renewed certificate after each renewal. With acme.sh or another ACME client, call the Tencent Cloud API (or the `tccli` command-line tool) from a renewal hook to upload the certificate and update the CDN domain; check the current API names in Tencent Cloud's API documentation. Public certificates last at most 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, so manual replacement will not keep up. Automate it and add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development). ## Troubleshooting - **Certificate and key do not match**: see [nginx key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/) and check with the [key matcher](https://ssl.sh/tools/key-matcher/). - **Some phones or mini programs distrust the certificate**: only the leaf was uploaded; add the intermediate, see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/). - **Endless redirects**: both the origin and the CDN redirect; see the FAQ and [redirect HTTP to HTTPS](https://ssl.sh/guides/redirect-http-to-https/). - **HTTPS configuration fails to save with an HTTPS origin**: the origin does not listen on 443 or its certificate is invalid for the origin host. - **Visitors see an expired certificate**: your own certificate was not replaced; see [NET::ERR_CERT_DATE_INVALID](https://ssl.sh/errors/net-err-cert-date-invalid/). - **Some content is marked insecure**: the page loads HTTP resources; see [mixed content warning](https://ssl.sh/errors/mixed-content-warning/).