Help Center/ Object Storage Service/ User Guide/ Domain Name Management/ Certificate Hosting

Updated on 2026-08-21 GMT+08:00

Certificate Hosting

Scenarios

If you want to access a bucket using a user-defined domain name over HTTPS, you need to configure an HTTPS certificate for the domain name. In HTTPS, digital certificates are essential for securing communication, preserving data integrity, and verifying identity.

Identity authentication uses a certificate to verify that a server is who it claims to be. This in turn helps defend against man-in-the-middle (MITM) attacks and protects users from connecting to a forged phishing website. In certain scenarios (for example, internal enterprise systems), HTTPS mutual authentication can be implemented using digital certificates. In this setup, the client is also required to present a certificate for the server to verify its identity, thereby further enhancing security.
Data encryption protects the confidentiality of communications by setting up an encrypted channel between the client and the server. This ensures that the transmitted data (such as passwords, credit card information, and chat content) remains secure. Even if the data is intercepted, it cannot be read.
Data integrity protects data from being tampered with. During HTTPS transmission, a hash function (for example, SHA-256) is used to create a message digest and this digest is then encrypted using a session key. This ensures that data is not tampered with or replaced during transmission.

How It Works

HTTPS uses TLS/SSL to provide end-to-end data encryption between the client and the server. It also uses certificates to verify the server identity, ensuring data confidentiality and integrity as well as correct sender identification.

To access OBS over HTTPS, you must configure a valid SSL certificate for the access domain name.

Default bucket domain name: The format is bucketname.obs.regionid.myhuaweicloud.com. SSL certificates are managed centrally by Huawei Cloud, and HTTPS is enabled by default. You can access the bucket directly using the https:// prefix.
User-defined domain name: You must configure a certificate when setting a user-defined domain name for a bucket. For details, see Configuring a User-Defined Domain Name. You can also configure a certificate after the domain name is set. For details, see Configuring an HTTPS Certificate for a User-Defined Domain Name.
OBS supports international certificates.
CDN acceleration domain name: If a CDN acceleration domain name is configured for a bucket, you must configure a certificate. For details, see Configuring an HTTPS Certificate.

Constraints

HTTPS certificate hosting is only available for user-defined domain names.
Only common certificates are supported. Chinese cryptographic certificates are not supported.
When HTTPS certificates are required, a maximum of 100 user-defined domain names can be configured for each bucket.

Billing Description

To configure certificates for a domain name to access OBS over HTTPS, you must purchase a certificate. For details about the billing of purchasing a certificate on Huawei Cloud, see CCM Billing Items.

Certificate Format

A certificate consists of two parts: the certificate file and the private key.

The certificate file must meet the following requirements:

The certificate file must include information such as the public key and signature. Its file name extension must be .pem or .crt.

The certificate file is prefixed with -----BEGIN CERTIFICATE----- and postfixed with -----END CERTIFICATE-----.
The certificate file cannot contain blank lines. Each line must contain exactly 64 characters, except for the last line, which can contain fewer.

Example:

The private key must meet the following requirements:

The private key must have the .key extension and must not have a password. The format of the private key is as follows:

The private key is a PEM encoded file.
- The private key is prefixed with -----BEGIN RSA PRIVATE KEY----- and postfixed with -----END RSA PRIVATE KEY-----.
The private key cannot contain blank lines. Each line must contain exactly 64 characters, except for the last line, which can contain fewer.

Example:

Configuring an HTTPS Certificate for a User-Defined Domain Name

You can use OBS Console, APIs, or obsutil to configure HTTPS certificates for user-defined domain names. You cannot use SDKs or OBS Browser+ to do so.

Using OBS Console

In the navigation pane of OBS Console, choose Buckets.
In the bucket list, click the desired bucket. The Objects page is displayed.
In the navigation pane, choose Domain Name Mgmt.
On the domain name list page, click Configure next to User Domain Name HTTPS Configuration on the right of the target domain name.

If an HTTPS certificate has been configured, click Edit to modify the certificate.

Configure HTTPS parameters.

**Table 1** HTTPS certificate parameters
Parameter	Description
Status	Determines whether to enable HTTPS. By enabling the Status button, you can use a user-defined domain name to access objects stored in OBS over HTTPS, which is more secure. By default, the Status button is disabled, which means HTTPS is not enabled.
Certificate	Choose the SCM certificate, which is a server digital certificate provided by Cloud Certificate & Manager (CCM). If you do not have a certificate, click Buy Certificate to purchase one on the CCM console. For details, see Purchasing an SSL Certificate. Each certificate has an expiration time. Ensure that the certificate you chose has not expired. Replace the certificate before it expires, or services may be affected.For details about how to check the certificate validity period, see How Do I Know When My Certificate Expires? If you cannot select any existing certificate, check whether your account has the scm:cert:list and scm:cert:download permissions. If not, add these permissions. For details, see Assigning Permissions to an IAM User.

Click OK.

Using APIs

You can use an API to upload a certificate:

Configuring a Custom Domain Name for a Bucket

Obtaining the Custom Domain Name of a Bucket

Using the CLI Tool - obsutil

Command Line Structure

Windows

obsutil custom-domain obs://bucket -method=put -cname=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

macOS or Linux

./obsutil custom-domain obs://bucket -method=put -cname=xxx  [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

Examples

Take Windows as an example. Run obsutil custom-domain obs://test-bucket -method=put -cname=www.obs-example.com to bind www.obs-example.com to bucket test-bucket.

obsutil custom-domain obs://test-bucket -method=put -cname=www.obs-example.com 

Start at 2024-09-30 07:59:28.8675681 +0000 UTC

Put customDomain configuration succeed for bucket [test-bucket], customDomain is [www.obs-example.com], requestId is [00000199765243C44018D688E9F5CFF5]

Parameters

Parameter	Optional or Mandatory	Description
bucket	Mandatory	The bucket name
method	Mandatory	The method. Set it to put when you configure a user-defined domain name for a bucket.
cname	Mandatory	The user-defined domain name for the bucket A bucket can have up to 30 user-defined domain names. One user-defined domain name can only be used for one bucket. A bucket can have up to 100 user-defined domain names. One user-defined domain name can only be used for one bucket. When a certificate is bound, it takes effect in 60 seconds.
certificateName	Optional (additional parameter)	The certificate name. It can be 3 to 63 characters long. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed.
certificateId	Optional (additional parameter)	The certificate ID
certificate	Optional (additional parameter)	The certificate content. It can contain intermediate and root certificates. If the certificate_chain field contains a certificate chain, the certificate field should include only the certificate itself. Use escape characters \n or \r\n for line breaks.
certificateChain	Optional (additional parameter)	The certificate chain, which can be passed through the certificate field. Use escape characters \n or \r\n for line breaks.
privateKey	Optional (additional parameter)	The private key of the certificate. An encrypted private key cannot be uploaded. Use escape characters \n or \r\n to replace line breaks.
config	Optional (additional parameter)	The user-defined configuration file for executing the current command. For details about parameters that can be configured, see Configuration Parameters.
e	Optional (additional parameter)	The endpoint
i	Optional (additional parameter)	The user's AK
k	Optional (additional parameter)	The user's SK
t	Optional (additional parameter)	The user's security token

Accessing an Object over HTTPS

After configuring HTTPS for a user-defined domain name, use a browser to verify HTTPS access to your objects through that domain name. You can use SDKs to access objects over HTTPS through a user-defined domain name. You cannot use OBS Console, APIs, OBS Browser+, or obsutil to do so.

Using SDKs

Obtain a pre-signed URL.

The following are example codes in common programming languages:

Java

import com.obs.services.ObsClient;
import com.obs.services.ObsConfiguration;
import com.obs.services.model.HttpMethodEnum;
import com.obs.services.model.TemporarySignatureRequest;
import com.obs.services.model.TemporarySignatureResponse;
public class GetObject001 {
    public static void main(String[] args) {
        // Obtain an AK/SK pair using environment variables or import it in other ways. Using hard coding may result in leakage.
        // Obtain an AK/SK pair on the management console.
        String ak = System.getenv("ACCESS_KEY_ID");
        String sk = System.getenv("SECRET_ACCESS_KEY_ID");
        // (Optional) If you are using a temporary AK/SK pair and a security token to access OBS, you are advised not to use hard coding, which may result in information leakage.
        // Obtain an AK/SK pair and a security token using environment variables or import them in other ways. If you use a temporary AK/SK pair and a security token to make an API call, uncomment the following line.
        // String securityToken = System.getenv("SECURITY_TOKEN");

        // Set the endpoint to the bucket's user-defined domain name. If the user-defined domain name has a certificate configured, you can use https.
        String endPoint = "http://example.domain";
        // Obtain an endpoint using environment variables or import it in other ways.
        //String endPoint = System.getenv("ENDPOINT");

        ObsConfiguration obsConfiguration = new ObsConfiguration();
        obsConfiguration.setCname(true);
        obsConfiguration.setEndPoint(endPoint);
        try {
            // Create an ObsClient instance.
            // Use the permanent AK/SK pair to initialize the client.
            ObsClient obsClient = new ObsClient(ak, sk, obsConfiguration);
            // Use a temporary AK/SK pair and security token to initialize the client.
            // ObsClient obsClient = new ObsClient(ak, sk, securityToken, obsConfiguration);

            // Set the validity period of the URL to 3600 seconds.
            long expireSeconds = 3600L;
            TemporarySignatureRequest request = new TemporarySignatureRequest(HttpMethodEnum.GET, expireSeconds);
            request.setBucketName("examplebucket");
            request.setObjectKey("objectname");
            TemporarySignatureResponse response = obsClient.createTemporarySignature(request);
            System.out.println("Getting object using temporary signature url:");
            System.out.println("SignedUrl:" + response.getSignedUrl());
        } catch (Exception e) {
            System.out.println("create temporary signature failed");
            e.printStackTrace();
        }
    }
}

Python

from obs import ObsClient
import os
import traceback
# Obtain an AK and SK pair using environment variables (recommended) or import it in other ways. Using hard coding may result in leakage.
# Obtain an AK/SK pair on OBS Console by referring to https://support.huaweicloud.com/en-us/usermanual-ca/ca_01_0003.html.
ak = os.getenv("AccessKeyID")
sk = os.getenv("SecretAccessKey")
# (Optional) If you use a temporary AK/SK pair and a security token to access OBS, obtain them using environment variables.
# security_token = os.getenv("SecurityToken")
# Set the server to the bucket's user-defined domain name. If the user-defined domain name has a certificate configured, you can use https.
server = "http://example.domain"
# Create an ObsClient instance.
obsClient = ObsClient(access_key_id=ak, secret_access_key=sk, server=server, is_cname=True)

# If you use a temporary AK/SK pair and a security token to access OBS, you must specify security_token when creating an instance.
#obsClient = ObsClient(access_key_id=ak, secret_access_key=sk, security_token=security_token, server=server, is_cname=True)

try:
    # Create a signed URL for downloading an object.
    res = obsClient.createSignedUrl(method='GET', bucketName='bucketname', objectKey='objectkey', expires=3600)
    print('signedUrl:', res.signedUrl)
except:
    print(traceback.format_exc())

Access the pre-signed URL in a browser.

Forcing Clients to Access OBS over HTTPS

In scenarios requiring strict transmission security, you can configure a bucket policy to reject HTTP requests from all clients, preventing data from being intercepted or tampered with during transmission.

In the navigation pane of OBS Console, choose Buckets.
In the bucket list, click the desired bucket. The Objects page is displayed.
In the navigation pane, choose Permissions > Bucket Policies.
Click Create.

Configure a bucket policy.

Figure 1 Configuring a bucket policy
Click to enlarge

**Table 2** Parameters for configuring a custom bucket policy
Parameter	Value Example	Description
Policy View	Visual Editor	Choose Visual Editor or JSON. The visual editor is used here. For details about configurations in the JSON view, see Creating a Custom Bucket Policy (JSON View).
Policy Name	deny_http	Enter a custom policy name. The policy name cannot be left blank.
Effect	Deny.	Allow: The policy allows the matched requests. Deny: The policy denies the matched requests.
Principal	All accounts	All accounts: The bucket policy applies to all Internet users. Current account: You can select one or more IAM users under the current account. Other accounts: You can set one or more other accounts. The account ID and IAM user ID can be obtained from the My Credentials page. You can click Add Other Account to add multiple accounts. If you enter an IAM user ID or name as , you are granting permissions to all users under the account. Delegated account: You can set one or more delegated accounts. You can click Add Delegated Account* to add multiple delegated accounts.
Resources	Entire bucket (including the objects in it)	Entire bucket (including the objects in it): The policy applies to the bucket and the objects in it. You can configure bucket and object actions in this policy. Current bucket: The policy applies to the current bucket. You can configure bucket actions in this policy. Specified objects: The policy applies to specified objects in the bucket. You can configure object actions in this policy. Multiple resource paths can be specified. A resource path should be configured in the Folder name/Object name format, for example, testdir/a.txt. To specify the testdir folder and all objects in it, enter testdir/. You can specify a specific object, an object set, or a directory. indicates all objects in the bucket. To specify a specific object, enter the object name. To specify a set of objects, enter Object name prefix, Object name suffix, or . For example, testdir/ indicates objects in the testdir folder, and testprefix* indicates objects with the prefix testprefix.
Actions	Customize * for Select Actions	Configure the actions authorized by the bucket policy. You can use a template or customize the configuration. Use a template: OBS preconfigures multiple bucket policy templates for common scenarios, helping you quickly configure bucket policies. For details, see Creating a Bucket Policy with a Template. Customize: You can customize authorization actions. If you select Customize, you also need to select specific actions. Select Actions: See Bucket Policy Parameters. NOTE: If you select Entire bucket (including the objects in it) for Resources, common actions, bucket actions, and object actions will be available for you to choose from. If you select Current bucket for Resources, common actions and bucket actions will be available for you to choose from. If you select Specified objects for Resources, common actions and object actions will be available for you to choose from. If you select both Current bucket and Specified objects for Resources, common actions, bucket actions, and object actions will be available for you to choose from.
Conditions (Optional)	Key: SecureTransport Qualifier: default Condition Operator: Bool Value: false	This parameter is optional. Use this parameter to specify the conditions for a bucket policy to take effect. Key: See Bucket Policy Parameters. Tag Key: See Bucket Policy Parameters. Qualifier: See Bucket Policy Parameters. Condition Operator: See Bucket Policy Parameters. Value: The entered value is associated with the key.

Click Create in the lower right corner.

You can also use JSON to configure a bucket policy to deny HTTP requests from all clients.

{
    "Statement": [
        {
            "Sid": "deny_http",
            "Effect": "Deny",
            "Principal": {
                "ID": [
                    "*"
                ]
            },
            "Action": [
                "*"
            ],
            "Resource": [
                "dfhjhkmk",
                "dfhjhkmk/*"
            ],
            "Condition": {
                "Bool": {
                    "SecureTransport": [
                        "false"
                    ]
                }
            }
        }
    ]
}

Managing the Certificate Lifecycle

Checking the Certificate Expiration Time

If your certificate is hosted by Cloud Certificate & Manager (CCM) of Huawei Cloud, check the certificate expiration time by referring to Viewing Details About an SSL Certificate.
If your certificate is hosted by another service provider, check the certificate expiration time with that provider.

Replacing the Certificate Configured for a Domain Name

To replace the certificate configured for a domain name, perform the following steps:

In the navigation pane of OBS Console, choose Buckets.
In the bucket list, click the desired bucket. The Objects page is displayed.
In the navigation pane, choose Domain Name Mgmt.
On the domain name list page, click Edit next to User Domain Name HTTPS Configuration on the right of the target domain name.

Configure HTTPS parameters.

**Table 3** HTTPS certificate parameters
Parameter	Description
Status	Determines whether to enable HTTPS. By enabling the Status button, you can use a user-defined domain name to access objects stored in OBS over HTTPS, which is more secure. By default, the Status button is disabled, which means HTTPS is not enabled.
Certificate	Choose the SCM certificate, which is a server digital certificate provided by Cloud Certificate & Manager (CCM). If you do not have a certificate, click Buy Certificate to purchase one on the CCM console. For details, see Purchasing an SSL Certificate. Each certificate has an expiration time. Ensure that the certificate you chose has not expired. Replace the certificate before it expires, or services may be affected.For details about how to check the certificate validity period, see How Do I Know When My Certificate Expires? If you cannot select any existing certificate, check whether your account has the scm:cert:list and scm:cert:download permissions. If not, add these permissions. For details, see Assigning Permissions to an IAM User.

Click OK.

Renewing a Certificate

An SSL certificate has a fixed validity period. After it expires, the server cannot perform HTTPS-encrypted communication. To prevent service interruptions caused by expiration, renew the SSL certificate 30 days before it expires.

If your certificate is hosted by Huawei Cloud CCM, renew the certificate by referring to Auto-Renewal.
If your certificate is hosted by another service provider, renew the certificate with that provider.

Disabling HTTPS Access

You can use OBS Console, APIs, SDKs, or obsutil to disable HTTPS access for user-defined domain names. You cannot use OBS Browser+ to do so.

Using OBS Console

In the navigation pane, choose Domain Name Mgmt.
On the domain name list page, click Edit next to User Domain Name HTTPS Configuration on the right of the target domain name.
Disable Status and click OK.

Using APIs

You can use an API to upload a certificate:

Configuring a Custom Domain Name for a Bucket

Obtaining the Custom Domain Name of a Bucket

Using the CLI Tool - obsutil

Command Line Structure

Windows

obsutil custom-domain obs://bucket -method=put -cname=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

macOS or Linux

./obsutil custom-domain obs://bucket -method=put -cname=xxx  [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

Examples

Take Windows as an example. Run obsutil custom-domain obs://test-bucket -method=put -cname=www.obs-example.com to bind www.obs-example.com to bucket test-bucket.

obsutil custom-domain obs://test-bucket -method=put -cname=www.obs-example.com 

Start at 2024-09-30 07:59:28.8675681 +0000 UTC

Put customDomain configuration succeed for bucket [test-bucket], customDomain is [www.obs-example.com], requestId is [00000199765243C44018D688E9F5CFF5]

Parameters

Parameter	Optional or Mandatory	Description
bucket	Mandatory	The bucket name
method	Mandatory	The method. Set it to put when you configure a user-defined domain name for a bucket.
cname	Mandatory	The user-defined domain name for the bucket A bucket can have up to 30 user-defined domain names. One user-defined domain name can only be used for one bucket. A bucket can have up to 100 user-defined domain names. One user-defined domain name can only be used for one bucket. When a certificate is bound, it takes effect in 60 seconds.
certificateName	Optional (additional parameter)	The certificate name. It can be 3 to 63 characters long. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed.
certificateId	Optional (additional parameter)	The certificate ID
certificate	Optional (additional parameter)	The certificate content. It can contain intermediate and root certificates. If the certificate_chain field contains a certificate chain, the certificate field should include only the certificate itself. Use escape characters \n or \r\n for line breaks.
certificateChain	Optional (additional parameter)	The certificate chain, which can be passed through the certificate field. Use escape characters \n or \r\n for line breaks.
privateKey	Optional (additional parameter)	The private key of the certificate. An encrypted private key cannot be uploaded. Use escape characters \n or \r\n to replace line breaks.
config	Optional (additional parameter)	The user-defined configuration file for executing the current command. For details about parameters that can be configured, see Configuration Parameters.
e	Optional (additional parameter)	The endpoint
i	Optional (additional parameter)	The user's AK
k	Optional (additional parameter)	The user's SK
t	Optional (additional parameter)	The user's security token

References

Risk Prevention for HTTPS

To prevent HTTPS-encryption communication failures caused by certificate configuration errors that cannot be quickly rectified or by certificate expiration, you are advised to take the following precautions:

Standby certificate mechanism: Prepare a standby certificate in advance so that you can immediately replace the primary certificate if it becomes invalid.
HTTP access fallback policy: If the certificate configuration is incorrect and cannot be quickly fixed, you can temporarily allow HTTP access.
If you have configured a bucket policy to forcibly use HTTPS to access OBS, as described in Forcing Clients to Access OBS over HTTPS, and if the certificate configuration is incorrect and cannot be quickly fixed, delete the bucket policy first. After the certificate issue is resolved, reconfigure the bucket policy.

Why Does the Browser Still Show an Insecure Connection or Incorrect Certificate After an SSL Certificate Is Configured?

If a security warning is still displayed after the certificate is configured, perform the following operations:

Clear the browser cache: The browser may have cached the previous certificate status. Clear the cache and try again.
Wait for the configuration to take effect: It may take several minutes for the certificate configuration to take effect. Wait briefly and use the browser to access OBS again.
Verify the configuration: Check whether the certificate configuration is disabled after the certificate is configured. If it is disabled, enable and reconfigure the certificate.

What Should I Do If a Certificate Exception Occurs When I Access OBS over HTTPS?

Troubleshoot the issue based on the certificate exception type:

Browser error message "NET::ERR_SSL_PROTOCOL_ERROR": The certificate may not be configured.
- If domain name acceleration is not enabled or no acceleration domain name is configured, configure a certificate by referring to Configuring an HTTPS Certificate for a User-Defined Domain Name.
- If domain name acceleration has been enabled or an acceleration domain name has been configured, configure the certificate by referring to Configuring an HTTPS Certificate.
NET::ERR_CERT_DATE_INVALID: The certificate has expired. Replace the certificate by referring to Replacing the Certificate Configured for a Domain Name.
NET::ERR_CERT_COMMON_NAME_INVALID: The certificate does not match the domain name. The accessed domain name is not within the domain name scope of the configured certificate (example: the accessed domain name is test.example.com but the certificate is bound to test01.example.com), configure a correct certificate for the accessed domain name.

Why Can't I Find the Desired Certificate in the Certificate Drop-down List When Configuring a Certificate?

The possible causes are as follows:

The certificate does not match the domain name: The system lists only certificates bound to the current domain name. For example, when configuring a certificate for test.example.com, you cannot select any certificate bound to test01.example.com.
The certificate is not under the current account: Upload the certificate on the CCM console.
The wildcard domain certificate does not match the domain name level: A wildcard domain certificate supports only domain names at the same level. For example, *.example.com can match www.example.com and obs.example.com, but not test.obs.example.com.

FAQs About Configuring Certificates for Acceleration Domain Names in CDN

The following are common questions about configuring HTTPS for acceleration domain names in CDN:

Parent Topic: Domain Name Management

Previous topic: Configuring Auto Cache Refresh for the CDN Acceleration Domain Name of a Bucket

Next topic: Data Management

Certificate Hosting

Scenarios

How It Works

Constraints

Billing Description

Certificate Format

Configuring an HTTPS Certificate for a User-Defined Domain Name

Using OBS Console

Using APIs

Using the CLI Tool - obsutil

Accessing an Object over HTTPS

Using SDKs

Forcing Clients to Access OBS over HTTPS

Managing the Certificate Lifecycle

Checking the Certificate Expiration Time

Replacing the Certificate Configured for a Domain Name

Renewing a Certificate

Disabling HTTPS Access

Using OBS Console

Using APIs

Using the CLI Tool - obsutil

References

Risk Prevention for HTTPS

Why Does the Browser Still Show an Insecure Connection or Incorrect Certificate After an SSL Certificate Is Configured?

What Should I Do If a Certificate Exception Occurs When I Access OBS over HTTPS?

Why Can't I Find the Desired Certificate in the Certificate Drop-down List When Configuring a Certificate?

FAQs About Configuring Certificates for Acceleration Domain Names in CDN

What is your overall rating for this page?