Skip to main content

Add an SSL certificate to deliver content over HTTPS

An SSL certificate associates a domain with a public key and allows clients to verify the server's identity. HTTPS protects sensitive data in transit, including financial information. The SSL certificate overview explains how certificates establish encrypted connections.

To deliver content over HTTPS through Orange's CDN, attach an SSL certificate to a CDN resource that uses a custom domain.

Only one certificate can be attached per CDN resource.

SSL certificate types in CDB

Two SSL certificate types are available:

  • Custom SSL certificate. A third-party certificate authority issues the certificate for the custom domain. Upload the certificate in the Customer Portal and attach it to the CDN resource.

  • Free Let's Encrypt certificate. Select a free Let's Encrypt certificate for the custom domain. CDB issues and attaches it automatically.

SSL configuration

Configure HTTPS on a CDN resource or upload a custom certificate for later use.

CDN resource HTTPS

Attach a certificate from the CDN resource settings:

  1. 1

    Open the CDN resource

    In the CDB Technical Web Portal, navigate to CDN > CDN resources and open the resource.

  2. 2

    Enable HTTPS

    Open SSL and turn on Enable HTTPS.

  3. 3

    Select a certificate

    Select Free Let's Encrypt certificate or Custom SSL certificate. For a custom certificate, select the uploaded certificate from the list of available certificates.

  4. 4

    Apply the configuration

    Click Save changes.

For custom uploads, the custom certificate procedure covers entering the certificate name, certificate chain, and private key, configuring the certificate-authority option, and submitting the form.

Attach an existing SSL certificate to a CDN resource so viewers can request the content over HTTPS, while Let's Encrypt issuance stays in the Let's Encrypt article.

An API token is required, along with an existing CDN resource and an uploaded SSL certificate.

export GCORE_API_KEY="{YOUR_API_KEY}"

List the account SSL certificates

The certificate list returns each certificate id, so select the certificate by name and use that id as sslData.

from gcore import CDB

client = CDB()  # Reads GCORE_API_KEY from env

certificates = client.cdn.certificates.list()
cert_id = next(item.id for item in certificates if item.name == "cdn.mywebsite.com")
print(cert_id)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient() // Reads GCORE_API_KEY from env
    ctx := context.Background()

    page, err := client.CDN.Certificates.List(ctx, cdn.CertificateListParams{})
    if err != nil {
        panic(err)
    }
    var certID int64
    for _, item := range page.Results {
        if item.Name == "cdn.mywebsite.com" {
            certID = item.ID
            break
        }
    }
    fmt.Println(certID)
}

curl "https://api.cdb-staging.cdn.orange.com/cdn/sslData?limit=1000" \
  -H "Authorization: APIKey $GCORE_API_KEY"

The API returns:

{
  "results": [
    {
      "id": 1003,
      "name": "cdn.mywebsite.com"
    }
  ]
}

Attach the certificate to the resource

A resource update sets sslEnabled to true and sslData to the certificate id, while a request that sets sslEnabled to true without sslData returns HTTP 400 with the message Invalid certificate.

ParameterRequiredDescription
sslEnabledNoOptional in the API. Set to true to enable HTTPS
sslDataNoOptional in the API. Required when sslEnabled is true; use the certificate id from the list request
from gcore import CDB

client = CDB()

resource = client.cdn.cdn_resources.update(
    1001,
    ssl_enabled=True,
    ssl_data=1003,
)
print(resource.ssl_enabled, resource.ssl_data)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    resource, err := client.CDN.CDNResources.Update(ctx, 1001, cdn.CDNResourceUpdateParams{
        SslEnabled: gcore.Bool(true),
        SslData:    gcore.Int(1003),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(resource.SslEnabled, resource.SslData)
}

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/cdn/resources/1001" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sslEnabled": true,
    "sslData": 1003
  }'

The API returns:

{
  "id": 1001,
  "sslEnabled": true,
  "sslData": 1003
}

Disable HTTPS on the resource

The same update turns HTTPS off when sslEnabled is false, so the response sslData is null.

from gcore import CDB

client = CDB()

resource = client.cdn.cdn_resources.update(1001, ssl_enabled=False)
print(resource.ssl_enabled, resource.ssl_data)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    resource, err := client.CDN.CDNResources.Update(ctx, 1001, cdn.CDNResourceUpdateParams{
        SslEnabled: gcore.Bool(false),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(resource.SslEnabled, resource.SslData)
}

curl -X PATCH "https://api.cdb-staging.cdn.orange.com/cdn/resources/1001" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sslEnabled": false}'

The API returns:

{
  "id": 1001,
  "sslEnabled": false,
  "sslData": null
}

Attach an existing SSL certificate to a CDN resource with the Terraform provider v2. The resource uses a custom domain, while Let's Encrypt issuance stays in the Let's Encrypt article.

Only one certificate can be attached per CDN resource.

An uploaded certificate is required, because the data source reads it when Terraform plans.

Attach the certificate

Select the certificate by name from the account list and set ssl_enabled and ssl_data on the CDN resource, because creating the resource with ssl_enabled set to true and no ssl_data returns HTTP 400 with the message Invalid certificate.

data "gcore_cdn_certificates" "account" {}

locals {
  ssl_certificate_id = one([
    for certificate in data.gcore_cdn_certificates.account.items :
    certificate.id if certificate.name == "cdn.mywebsite.com"
  ])
}

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_resource" "example" {
  cname           = "https.mywebsite.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = true
  ssl_data        = local.ssl_certificate_id
}

Disable HTTPS

Set ssl_enabled to false and remove ssl_data, then run terraform apply, so the API clears the certificate id, while Terraform state can still show the previous id until the next plan, which records ssl_data as null and does not attach the certificate again.

resource "gcore_cdn_origin_group" "example" {
  name = "my-origin-group"

  sources = [
    {
      source  = "example.com"
      enabled = true
    }
  ]
}

resource "gcore_cdn_resource" "example" {
  cname           = "https.mywebsite.com"
  origin_group    = gcore_cdn_origin_group.example.id
  origin_protocol = "HTTPS"
  ssl_enabled     = false
}

Content delivery over HTTPS

Wait at least 15 minutes after the certificate is attached, then request the custom domain over HTTPS, so a successful connection confirms that the CDN delivers the content.