# Tencent Cloud free SSL certificate: apply, validate, install > Apply for Tencent Cloud's free TrustAsia DV certificate, validate by DNS or file, install the Nginx bundle on your server, or quick-deploy it to CDN. Source: https://ssl.sh/guides/tencent-cloud-ssl-certificate/ Last updated: 2026-11-10 Tencent Cloud's SSL Certificate Service issues a free 3-month TrustAsia DV certificate for one domain name. Apply in the console, validate by DNS or file, then install the Nginx package on your server or quick-deploy the certificate to a Tencent Cloud product such as CDN. Steps follow the Tencent Cloud International documentation as of November 2026; quotas and labels can differ between the international console and the China console, so trust what your console shows. ## What the free certificate is Tencent Cloud International offers a free DV certificate issued by TrustAsia. It covers a single domain name (for example `www.example.com`), and since April 25, 2024 it is valid for 3 months instead of 12. It is not renewed automatically: Tencent Cloud documents auto-renewal for paid certificates only, so each free certificate is a new application. The 3-month validity is already below the CA/Browser Forum caps of 200 days (since March 15, 2026) and 100 days (from March 15, 2027), but the 47-day cap that starts on March 15, 2029 is shorter still, and paid certificates are shortened by every step. ## Prerequisites Prepare the domain and a validation method first. - A Tencent Cloud account with access to the SSL Certificate Service console. - The domain, for example `www.example.com`, and access to its DNS records or to the website's document root. - An ICP filing if the site will be served from the Chinese mainland. Tencent Cloud requires one for domains running in the mainland, including CDN domains whose acceleration region is the Chinese mainland or global. - For file validation, the site reachable on port 80 or 443. ## Step 1: Apply for the free certificate In the SSL Certificate Service console open **My Certificates** and choose to apply for a free certificate. Enter the domain (one name only), a contact email, and leave the private key password empty (see the FAQ). Submit to reach the validation step. ## Step 2: Validate the domain The console offers three methods: - **Automatic DNS addition**: for domains hosted on DNSPod. The console creates the record for you. - **DNS validation**: you add the record shown in the console at any DNS provider. For TrustAsia certificates this record is a **CNAME**; other brands use TXT. - **File validation**: you create a file with the random name and content shown on the **Validate Domain** page under `/.well-known/pki-validation/` in the site root. The site must answer on port 80 or 443 and return the file directly with status 200; Tencent Cloud's documentation advises against redirects, and wildcard names cannot use file validation. Check the record or file before asking the console to verify. Use the exact names from the console: ```bash dig +short CNAME .example.com curl -si http://www.example.com/.well-known/pki-validation/ | head -n 1 ``` The second command should print `HTTP/1.1 200 OK`. Issuance usually follows within minutes. ## Step 3: Download and install on Nginx In **My Certificates**, click **Download** in the **Operation** column and select **Nginx** as the server type. The archive contains a folder with `_bundle.crt`, `_bundle.pem`, `.key` and a `.csr` file you do not need. Packages also exist for Apache, Tomcat, IIS, GlassFish, JBoss, Jetty and WebLogic. ```bash sudo mkdir -p /etc/nginx/ssl sudo unzip www.example.com_nginx.zip -d /etc/nginx/ssl/ sudo chmod 600 /etc/nginx/ssl/*/*.key find /etc/nginx/ssl -type f ``` Use the bundle file as the certificate, as Tencent Cloud's Nginx guide does. Adjust the paths to the names in your archive: ```nginx server { listen 443 ssl; server_name www.example.com; ssl_certificate /etc/nginx/ssl/www.example.com_nginx/www.example.com_bundle.crt; ssl_certificate_key /etc/nginx/ssl/www.example.com_nginx/www.example.com.key; ssl_protocols TLSv1.2 TLSv1.3; } ``` Confirm the file holds the chain (two or more certificates), then reload: ```bash grep -c 'BEGIN CERTIFICATE' /etc/nginx/ssl/www.example.com_nginx/www.example.com_bundle.crt sudo nginx -t && sudo systemctl reload nginx ``` If the count is 1, add the intermediate as described in [install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/). ## Step 4 (optional): Deploy to Tencent Cloud products For CDN you do not need to download anything. Open the issued certificate, go to **Certificate Details**, click **Quick Deployment**, choose CDN as the deployment type, and select the domains. Tencent Cloud also lists Cloud Load Balancer (CLB) as a quick-deployment target, and its API can bind certificates to more products, including EdgeOne and COS. CDN-side settings are covered in [Tencent Cloud CDN HTTPS](https://ssl.sh/guides/tencent-cloud-cdn-https/). ## Verify The chain should be complete and the expiry date should match the console. Check the endpoint with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal: ```bash curl ssl.sh/www.example.com ``` If Nginx fails to start, check that the key belongs to the certificate with the [key matcher](https://ssl.sh/tools/key-matcher/). ## Renewal A free certificate lasts 3 months and must be applied for, validated and installed again each time. Ways to reduce the work: - On your own servers, switch to [acme.sh with the DNSPod API](https://ssl.sh/guides/acme-sh-dnspod-aliyun-dns/), which issues and renews Let's Encrypt certificates and reloads Nginx with no manual step. - For Tencent Cloud resources, use **Certificate Hosting** (**Add hosting**): when a hosted certificate is renewed, Tencent Cloud replaces it on the associated resources. Free certificates can be hosted; check the console for current conditions and charges. - Add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) as an outside check that also catches a certificate left on a server you forgot about. ## Troubleshooting - **Validation fails**: the CNAME was entered with the zone appended twice, the record has not propagated, or the validation file is redirected, served on the wrong port, or blocked by hotlink protection. - **CAA record prevents issuance**: CAA records do not allow the CA; see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). - **Nginx reports key values mismatch**: the key and certificate come from different downloads; see [nginx key values mismatch](https://ssl.sh/errors/nginx-key-values-mismatch/). - **Mini programs or Android say the certificate is untrusted**: the server sends the leaf without the intermediate; see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/). - **Browsers say the certificate expired**: the 3-month certificate was not replaced; see [NET::ERR_CERT_DATE_INVALID](https://ssl.sh/errors/net-err-cert-date-invalid/).