Managing Your Certificates in WAF

Lifecycle Management

Procedure

Prerequisites

• You have connected your website to WAF using cloud CNAME access or dedicated access, and set Client Protocol of the protected website to HTTPS.
• You have obtained the certificate file and private key. Only .pem certificates can be used in WAF. If the certificate is in other formats, convert it into .pem locally before uploading it.
• To buy a certificate through CCM, you must have enabled it.

Step 1: Apply for an SSL Certificate in CCM

You can apply for a certificate from Huawei Cloud CCM. After obtaining the certificate file and private key, you can use it in WAF. This section describes how to apply for an SSL certificate from Huawei Cloud CCM.

1. Buy an SSL certificate.
2. Apply for an SSL certificate.
3. Verify domain name ownership.
4. Verify the organization.
5. Issue an SSL certificate.
6. Push an SSL certificate to WAF.

Step 2: Upload a Certificate to WAF

If the certificate you applied for from Huawei Cloud CCM has been pushed to WAF, you do not need to upload it again.

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Objects > Certificates.
5. Above the certificate list, click Add Certificate.
6. On the Add Certificate panel, configure the following parameters and click OK.

   Table 1 Adding an international certificate.

   Parameter	Description	Example Value
   Certificate Type	Select the type of the certificate to be added. Select International.	Chinese
   Certificate Name	Enter a certificate name.	waf_international
   Certificate File	Public key certificate file, which is in PEM format and contains public information such as the public key, protected domain name, validity period, and CA. WAF delivers the certificate to the client during an HTTPS handshake for site identity verification and key encryption. Open the .pem file in the certificate you want to add as a text file and copy the certificate content in the file to the text box.	-----BEGIN CERTIFICATE----- MIIDIjCCAougAwIBAgIJALV96mEtVF4EMA0GCSqGSIb3DQEBBQUAMGoxCzAJBgNVBAYTAnh4MQswCQYDVQQIEwJ4eDELMAkGA1UEBxMCeHgxCzAJBgNVBAoTAnh4MQswCQYDVQQLEwJ -----END CERTIFICATE-----
   Private Key	Private key paired with the certificate file. The private key is in PEM format and stored in WAF. It is used to decrypt the session key and handshake signature. It is highly sensitive information and must be kept confidential. The certificate file must match the private key. Otherwise, the upload will fail. Open the .key file in the certificate you want to add as a text file and copy the private key in the file to the text box.	-----BEGIN RSA PRIVATE KEY----- MIICXQIBAAKBgQDFPN9ojPndxSC4E1pqWQVKGHCFlXAAGBOxbGfSzXqzsoyacotueqMqXQbxrPSQFATeVmhZPNVEMdvcAMjYsV/mymtAwVqVA6q/OFdX/b3UHO+b/VqLo3J5SrM -----END RSA PRIVATE KEY-----
   Check whether the certificate matches the private key.	Select this option. If the certificate does not match the private key, click Why Does My Certificate Not Match the Private Key?	-

Step 3: Apply a Certificate to a Protected Domain Name

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Objects > Certificates.
5. In the row containing the certificate you want to use, click Use in the Operation column.
6. In the displayed Domain Name dialog box, select the website you want to use the certificate for.
7. Click OK.

Step 4: Renew a Certificate Upon Expiration

You are advised to renew a certificate before it expires. Expired certificates can cause HTTPS access errors or WAF protection rule failures. You can also configure certificate expiration notifications on the alarm notification page in WAF.

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Assets > Protected Objects.
5. On the Protected Objects page, click the target domain name.
6. Click Modify next to the certificate name. On the Update Certificate panel, import a new certificate or select an existing certificate.
   • If you have uploaded a certificate to WAF, select Select existing certificate for Update Method and select the certificate that has been uploaded to WAF from the certificate drop-down list.
   • If you have not uploaded a certificate to WAF, select Import new certificate for Update Method and enter the certificate name, certificate file, and certificate private key. For details, see Uploading a Certificate to WAF.
   • If the certificate was applied for through Huawei Cloud CCM and has been pushed to WAF, select SCM certificate for Update Method and select the corresponding certificate from the certificate drop-down list.

Step 5: Share a Certificate with Multiple Domain Names

1. Log in to the WAF console.
2. Click in the upper left corner and select a region or project.
3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
4. In the navigation pane on the left, choose Objects > Certificates.
5. In the row containing the certificate you want to share, click More > Share in the Operation column.
6. In the displayed dialog box, select a handling method, and click OK.
   Figure 1 Sharing a certificate with other enterprise projects
   

   After completing the preceding configurations, you can perform the following operations to verify the configurations:

   1. In the certificate list of the source enterprise project, check whether the certificate sharing status is updated to Shared.
   2. Switch to the target enterprise project and view the shared certificate.
   3. On the domain name configuration page of the target enterprise project, you can select the shared certificate to use it for an HTTPS domain name.

After completing the preceding operations, you can apply for, upload, use, rotate, and share HTTPS certificates for websites protected by WAF across multiple enterprise projects. This enables full-lifecycle management of certificates and keeps your website traffic encrypted in transit. You are advised to enable certificate expiration notifications and rotate your certificate in a timely manner to prevent service by expired certificates.