Updating the Certificate Used for a Website

Prerequisites

• You have selected Cloud Mode - CNAME or Dedicated Mode for protection when adding the website to WAF.
  

  If you use cloud mode - load balancer access mode, you need to configure TLS security policies on the ELB console.

• Your website uses HTTPS as the client protocol.

Constraints

• Each domain name must have a certificate associated. A wildcard domain name can only use a wildcard domain certificate. If you only have single-domain certificates, add domain names one by one in WAF.
• Only .pem certificates can be used in WAF. If the certificate is not in .pem, before uploading it, convert it to .pem by referring to 6.
• Only accounts with the SCM Administrator and SCM FullAccess permissions can select SCM certificates.
• Before updating the certificate, ensure that your WAF instance and the certificate you want to upload belong to the same account.

Impact on the System

• It is recommended that you update the certificate before it expires. Otherwise, all WAF protection rules will fail to take effect, and there can be massive impacts on the origin server, even more severe than a crashed host or website access failures.
• Updating certificates does not affect services. The old certificate still works during the certificate replacement. The new certificate will take over the job once it has been uploaded and successfully associated with the domain name.
• Access to your website may be affected when you update the configurations of certificates used for backend servers or for domain names of your websites protected by WAF. To minimize these impacts, update the certificates during off-peak hours.

Updating the Certificate Used for a Website

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
4. In the navigation pane on the left, choose Website Settings.
5. In the Domain Name column, click the domain name of the website to go to the basic information page.
6. Click the edit icon next to the certificate name. In the Update Certificate dialog box, import a new certificate or select an existing certificate.
   • If you select Import new certificate for Update Method, enter a certificate name, and copy and paste the certificate file and private key into the corresponding text boxes.

     The newly imported certificates will be listed on the Certificates page. For more details, see Uploading a Certificate to WAF.

     

     WAF encrypts and saves the private key to keep it safe.

     Figure 1 Update Certificate
     
     Only .pem certificates can be used in WAF. If the certificate is not in .pem format, convert it into .pem locally by referring to Table 1 before uploading it.

     Table 1 Certificate conversion commands

     Format	Conversion Method
     CER/CRT	Rename the cert.crt certificate file to cert.pem.
     PFX	Obtain a private key. For example, run the following command to convert cert.pfx into key.pem: openssl pkcs12 -in cert.pfx -nocerts -out key.pem -nodes Obtain a certificate. For example, run the following command to convert cert.pfx into cert.pem: openssl pkcs12 -in cert.pfx -nokeys -out cert.pem
     P7B	Convert a certificate. For example, run the following command to convert cert.p7b into cert.cer: openssl pkcs7 -print_certs -in cert.p7b -out cert.cer Rename certificate file cert.cer to cert.pem.
     DER	Obtain a private key. For example, run the following command to convert privatekey.der into privatekey.pem: openssl rsa -inform DER -outform PEM -in privatekey.der -out privatekey.pem Obtain a certificate. For example, run the following command to convert cert.cer into cert.pem: openssl x509 -inform der -in cert.cer -out cert.pem

     

     • Before running an OpenSSL command, ensure that the OpenSSL tool has been installed on the local host.
     • If your local PC runs a Windows operating system, go to the command line interface (CLI) and then run the certificate conversion command.
   • If you select Select existing certificate for Update Method, select an existing certificate from the Certificate drop-down list.
     Figure 2 Selecting an existing certificate
     
     

     If there are no certificates available, click Purchase Certificate and purchase a certificate and push it to WAF.

   • If you select SCM certificate for Update Method, select a certificate managed in CCM. It can be a certificate you purchased through CCM or an external certificate you uploaded to CCM.
     

     The SCM certificate domain name must be the same as the one you added to WAF.

     Figure 3 Selecting an SCM certificate
     

7. Click Confirm.

Related Operations

Uploading a Certificate to WAF