How to get and deploy an SSL certificate on Tencent Cloud

Tencent Cloud's SSL Certificate Service issues a free 3-month TrustAsia DV certificate for one domain name. Apply in the console, validate by DNS or file, then install the Nginx package on your server or quick-deploy the certificate to a Tencent Cloud product such as CDN.

Steps follow the Tencent Cloud International documentation as of November 2026; quotas and labels can differ between the international console and the China console, so trust what your console shows.

What the free certificate is

Tencent Cloud International offers a free DV certificate issued by TrustAsia. It covers a single domain name (for example www.example.com), and since April 25, 2024 it is valid for 3 months instead of 12. It is not renewed automatically: Tencent Cloud documents auto-renewal for paid certificates only, so each free certificate is a new application.

The 3-month validity is already below the CA/Browser Forum caps of 200 days (since March 15, 2026) and 100 days (from March 15, 2027), but the 47-day cap that starts on March 15, 2029 is shorter still, and paid certificates are shortened by every step.

Prerequisites

Prepare the domain and a validation method first.

• A Tencent Cloud account with access to the SSL Certificate Service console.
• The domain, for example www.example.com, and access to its DNS records or to the website's document root.
• An ICP filing if the site will be served from the Chinese mainland. Tencent Cloud requires one for domains running in the mainland, including CDN domains whose acceleration region is the Chinese mainland or global.
• For file validation, the site reachable on port 80 or 443.

Step 1: Apply for the free certificate

In the SSL Certificate Service console open My Certificates and choose to apply for a free certificate. Enter the domain (one name only), a contact email, and leave the private key password empty (see the FAQ). Submit to reach the validation step.

Step 2: Validate the domain

The console offers three methods:

• Automatic DNS addition: for domains hosted on DNSPod. The console creates the record for you.
• DNS validation: you add the record shown in the console at any DNS provider. For TrustAsia certificates this record is a CNAME; other brands use TXT.
• File validation: you create a file with the random name and content shown on the Validate Domain page under /.well-known/pki-validation/ in the site root. The site must answer on port 80 or 443 and return the file directly with status 200; Tencent Cloud's documentation advises against redirects, and wildcard names cannot use file validation.

Check the record or file before asking the console to verify. Use the exact names from the console:

dig +short CNAME <record-name-from-console>.example.com
curl -si http://www.example.com/.well-known/pki-validation/<file-name> | head -n 1

The second command should print HTTP/1.1 200 OK. Issuance usually follows within minutes.

Step 3: Download and install on Nginx

In My Certificates, click Download in the Operation column and select Nginx as the server type. The archive contains a folder with <domain>_bundle.crt, <domain>_bundle.pem, <domain>.key and a .csr file you do not need. Packages also exist for Apache, Tomcat, IIS, GlassFish, JBoss, Jetty and WebLogic.

sudo mkdir -p /etc/nginx/ssl
sudo unzip www.example.com_nginx.zip -d /etc/nginx/ssl/
sudo chmod 600 /etc/nginx/ssl/*/*.key
find /etc/nginx/ssl -type f

Use the bundle file as the certificate, as Tencent Cloud's Nginx guide does. Adjust the paths to the names in your archive:

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/nginx/ssl/www.example.com_nginx/www.example.com_bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/www.example.com_nginx/www.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
}

Confirm the file holds the chain (two or more certificates), then reload:

grep -c 'BEGIN CERTIFICATE' /etc/nginx/ssl/www.example.com_nginx/www.example.com_bundle.crt
sudo nginx -t && sudo systemctl reload nginx

If the count is 1, add the intermediate as described in install an intermediate certificate.

Step 4 (optional): Deploy to Tencent Cloud products

For CDN you do not need to download anything. Open the issued certificate, go to Certificate Details, click Quick Deployment, choose CDN as the deployment type, and select the domains. Tencent Cloud also lists Cloud Load Balancer (CLB) as a quick-deployment target, and its API can bind certificates to more products, including EdgeOne and COS. CDN-side settings are covered in Tencent Cloud CDN HTTPS.

Verify

The chain should be complete and the expiry date should match the console. Check the endpoint with the SSL checker, or from any terminal:

curl ssl.sh/www.example.com

If Nginx fails to start, check that the key belongs to the certificate with the key matcher.

Renewal

A free certificate lasts 3 months and must be applied for, validated and installed again each time. Ways to reduce the work:

• On your own servers, switch to acme.sh with the DNSPod API, which issues and renews Let's Encrypt certificates and reloads Nginx with no manual step.
• For Tencent Cloud resources, use Certificate Hosting (Add hosting): when a hosted certificate is renewed, Tencent Cloud replaces it on the associated resources. Free certificates can be hosted; check the console for current conditions and charges.
• Add the domain to ssl.sh monitoring (in development) as an outside check that also catches a certificate left on a server you forgot about.

Troubleshooting

• Validation fails: the CNAME was entered with the zone appended twice, the record has not propagated, or the validation file is redirected, served on the wrong port, or blocked by hotlink protection.
• CAA record prevents issuance: CAA records do not allow the CA; see CAA record prevents issuance.
• Nginx reports key values mismatch: the key and certificate come from different downloads; see nginx key values mismatch.
• Mini programs or Android say the certificate is untrusted: the server sends the leaf without the intermediate; see missing intermediate certificate.
• Browsers say the certificate expired: the 3-month certificate was not replaced; see NET::ERR_CERT_DATE_INVALID.