Binding or Replacing a Certificate

Scenarios

Certificates are used by clients and servers to authenticate each other and are widely used in service scenarios that require higher data security. You can replace a certificate if it expires or needs updating. If the certificate is not properly configured, services may be disrupted.

You can follow this section to bind a certificate to a listener and replace a certificate. If a certificate is also used by other services such as WAF, replace the certificate on all these services to prevent service unavailability.

Replacing a certificate and private keys does not affect your applications.

Constraints

• Certificates can be bound to HTTPS, TLS, and QUIC listeners.
• If a certificate is expired, you need to manually replace or delete it.
• The new certificate takes effect immediately. The old certificate is used for established connections, and the new one is used for new connections.

Prerequisites

You have added a certificate by following the instructions in Adding a Certificate.

Binding a Certificate

You can bind a certificate when adding an HTTPS, TLS, or QUIC listener. For details, see:

• Adding an HTTPS Listener
• Adding a TLS Listener
• Adding a QUIC Listener

Setting a New Certificate When Editing a Listener

1. Go to the load balancer list page.
2. On the displayed page, locate the load balancer whose listener certificate needs to be replaced and click its name.
3. Click the Listeners tab, locate the listener, and click Edit in Operation column.
4. On the displayed dialog box, select a server certificate or CA certificate.
5. Click OK in the Edit dialog box.