Upload a digital certificate
Upload a server certificate, or create a CSR for your certificate authority to sign, and bind the certificate to a workload.
You can add a certificate that a certificate authority (CA) issued for your domain to Certificate Manager and bind it to a workload, from Azion Console, the Azion CLI, or the API. For a certificate that Azion requests from Let’s Encrypt and renews, refer to Request a Let’s Encrypt certificate. For the Trusted CA certificate that checks client certificates, refer to Configure mTLS on a workload.
A server certificate covers the hostnames a workload serves over HTTPS. You get one in either of two ways: you upload a certificate with its private key, or Certificate Manager creates a certificate signing request (CSR) and keeps the private key while your CA signs the certificate. Either way, a workload uses the certificate only once its tls.certificate field names it, and the certificate reads inactive until then.
An account that runs on API v3 with Domains selects the certificate on each domain instead. For more information, refer to Domains.
Prerequisites
Console
- A workload that lists your domain in its domains. To add the domain, refer to Add a custom domain to a workload.
- To upload a certificate: the certificate in PEM format and its private key, with no passphrase. RSA 2048 keys and P-256 keys are accepted.
- To create a CSR: a domain your account has permission to use.
- Access to Azion Console. For more information, refer to How to access Azion Console.
Upload a server certificate
Certificate Manager stores the certificate with its private key, and it never returns the private key afterward. Intermediate certificates are accepted with the certificate.
Console
To upload the certificate in Azion Console:
Access Azion Console > Certificate Manager.
Select Server Certificate.
In Name, enter a name, such as my-certificate.
In Certificate, paste the certificate, including its -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
In Private Key, paste the private key, including its -----BEGIN and -----END lines.
Select Create.
The certificate appears in Certificate Manager as a TLS Certificate.
A private key the API cannot read is refused with The provided private key is invalid. Please check the key and try again. Send the key that matches the certificate, in PEM format and without a passphrase.
Create a certificate signing request
A CSR lets your own CA sign the certificate while Certificate Manager generates and keeps the private key. Name the hostnames the workload lists in its domains. The API accepts a certificate whose names do not match those domains, so it does not catch the mismatch for you.
Console
The presets of the Create Digital Certificate page do not include a CSR. Create the CSR with the Azion CLI or the API first.
To copy the request in Azion Console:
Access Azion Console > Certificate Manager.
Select the entry that the CSR created. Its Edit Digital Certificate page opens.
In Certificate Signing Request (CSR), select Copy.
Azion Console shows “Successfully copied!”, and the request is ready to submit to your CA.
A request that names a hostname in a domain your account has no permission for is refused with This account cannot use certain common or alternative names because it does not have permission for their domain names. For the meaning of each CSR field, refer to Certificates.
Submit the request to the CA of your choice, such as DigiCert, GlobalSign, or IdenTrust. The CA validates the details in the request and, once it approves them, issues the signed certificate.
Add the signed certificate to the CSR entry
The certificate your CA signs completes the entry that the certificate signing request (CSR) created. Add it in Azion Console or with the API, in PEM format, including its -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
Console
To add the signed certificate in Azion Console:
Access Azion Console > Certificate Manager.
Select the entry that the CSR created. Its Edit Digital Certificate page opens.
In Certificate, paste the certificate your CA signed.
Select Save.
The entry holds the signed certificate, and you can bind it to a workload.
Bind the certificate to the workload
A workload uses a server certificate once its tls.certificate field holds the certificate’s ID. From that update on, the certificate reads active. Make sure the certificate covers the hostnames the workload lists in its domains: the API accepts a certificate whose names do not match them.
Console
To bind the certificate in Azion Console:
Access Azion Console > Workloads.
Select the workload that lists your domain. Its edit form opens.
In Protocol Settings, turn on HTTPS support if it is off.
In Digital Certificate, select your certificate in the My certificates group.
Select Save.
Azion Console shows “Your workload has been updated”.
A Trusted CA certificate in tls.certificate is refused with Invalid certificate type, MUST be an Edge Certificate. To go back to Azion’s own certificate, select Azion (SAN) in Digital Certificate, or send null in tls.certificate.
Binding a certificate is a workload change, which takes several minutes to reach all of Azion’s distributed infrastructure. Requests can receive the old or the new configuration meanwhile. For certificate errors and their fixes, refer to Troubleshoot Workloads.
Replace a certificate before it expires
A certificate you upload does not renew itself, and once its validity date passes, it no longer protects traffic. To replace it, upload the new certificate as Upload a server certificate describes, then bind it as Bind the certificate to the workload describes. The old entry reads inactive once no workload names it. Delete it after the new certificate is active and the change has propagated.
For why to switch while the old certificate is still valid, refer to Workloads best practices.