Add a Custom SSL Certificate

Managing your SSL Certificate on CloudCannon requires you to host your Site through CloudCannon. If an external service hosts your Site, please review its documentation on SSL Certificates.

You can purchase a Custom SSL Certificate from a trusted third-party provider and upload it to a Subdomain of your Custom Domain on CloudCannon. The certificate belongs to the Subdomain, so it covers every Site on that Subdomain. Each certificate you upload is saved to your Organization, so you can choose it for any Subdomain it covers, and the SSL Certificates page under Org Settings lists them all.

To add a certificate, you need:

• A name your team will recognize
• Public Key
• Private Key
• Certificate Chain (optional)

Your certificate must cover the Subdomain you are adding it to. CloudCannon reads the expiry date from the certificate, so you do not need to enter it.

CloudCannon can't renew a certificate you upload, so check its expiry date, and upload a new one before it expires.

Before we begin, this article assumes you have added a Custom Domain to your Site, or added a subdomain to your Custom Domain.

If your Organization already has the certificate, such as one you uploaded from Org Settings, select it from the Uploaded SSL certificate dropdown instead of the New custom SSL certificate option, and skip to step 15. The dropdown lists your Organization's uploaded certificates that haven't expired and aren't being removed.

To add a Custom SSL Certificate:

1. Log in to CloudCannon.
2. Select the Organization your Custom Domain is connected to.
3. Click the Custom Domains link in the App Sidebar. CloudCannon will open the Domains Browser.
4. Click the Card for the domain to which you want to add a certificate. CloudCannon will open the Summary tab of the Domain page.
5. Click the Subdomains tab. CloudCannon will open the list of Subdomains.
6. Click the Card for the Subdomain to which you want to add the certificate. CloudCannon will open the page for that Subdomain.
7. Click the Configure HTTPS button in the HTTPS section. CloudCannon will open the HTTPS for [Subdomain] modal.
8. Select the Use an SSL certificate you upload option under SSL certificate. CloudCannon will show the Uploaded SSL certificate dropdown below the options.
9. Select the New custom SSL certificate option from the Uploaded SSL certificate dropdown. CloudCannon will open the Add SSL Certificate modal.
10. Enter a name your team will recognize in the Name field.
11. Enter your certificate in the Public Key field.
12. Enter your private key in the Private Key field.
13. (Optional.) Enter your certificate chain in the Certificate Chain (optional) field.
14. Click the Add SSL Certificate button.
15. (Optional.) Check the Redirect http:// visitors to https:// checkbox under HTTP.
16. Click the Save HTTPS button.

CloudCannon will apply your Custom SSL Certificate to the selected Subdomain. The HTTPS section shows HTTPS is on and the date until which the certificate is valid. For what happens when it expires, please read the section on expiring uploaded certificates. If the Subdomain is set to use an uploaded certificate but none is selected, the HTTPS section shows HTTPS is off.

If the certificate does not cover the Subdomain, CloudCannon shows an error under the Public Key field and does not add the certificate.

To return to an auto-generated certificate, select the Let CloudCannon issue and renew it option in the HTTPS for [Subdomain] modal. CloudCannon starts issuing its own certificate for the Subdomain straight away. On CloudCannon Hosting and Cloudflare Proxy, CloudCannon removes the uploaded certificate from the Subdomain's Cloudflare custom hostname. For more information, please read our documentation on adding an auto-generated SSL Certificate.

When an uploaded certificate expires#

CloudCannon cannot renew an SSL Certificate you upload. The SSL Certificates page under Org Settings marks the certificate Expires soon 30 days before it expires, and CloudCannon emails you 14 days and 3 days before it expires. If you have access to the Health tab on your Organization Home page, which is available through a private Beta granted to individual accounts rather than to an Organization, its Uploaded SSL certificates are expiring soon check lists each Subdomain that uses the certificate from nine days before it expires.

Before the certificate expires, upload a new one and select it for each Subdomain that uses it, or remove the certificate so each Subdomain switches to the Let CloudCannon issue and renew it option while keeping HTTPS on. If a Subdomain still uses the certificate when it expires, CloudCannon switches that Subdomain to the Let CloudCannon issue and renew it option within the hour. Until CloudCannon issues the new certificate, visitors to the Subdomain may see a security warning in their browser.

Action required: the Custom SSL Certificate [Certificate Name] expires on [Date]

CloudCannon sends this email 14 days and 3 days before an SSL Certificate you uploaded expires, to everyone who can edit the settings of a Base Domain (the base-domain:settings:details:write permission) with a Subdomain that still uses the certificate. The email lists those Subdomains and what to do before the certificate expires, with an Open the Custom SSL Certificate page button.

Redirect HTTP to HTTPS#

Once HTTPS is on, visitors can open your Site on the more secure HTTPS URL. When you check the Redirect http:// visitors to https:// checkbox in the HTTPS for [Subdomain] modal, CloudCannon redirects anyone who opens the HTTP URL on the Subdomain, for every Site on it. For more information on HTTPS, please read our documentation on what an SSL Certificate is. For more information on redirects, please read our documentation on configuring HTTP redirects.

Upload a certificate from Org Settings#

You can upload a certificate before you choose it for a Subdomain, from the SSL Certificates page under Org Settings. Viewing the page requires the org:settings:certificate:read permission. The page lists your Organization's SSL Certificates, with the domains each one covers and its status.

To upload a certificate from Org Settings:

1. Log in to CloudCannon.
2. Select the Organization that has the certificate.
3. Click the Org Settings link in the App Sidebar. CloudCannon will open the Details page.
4. Click the SSL Certificates link under the Hosting heading. CloudCannon will open the SSL Certificates page.
5. Click the Add SSL Certificate button. CloudCannon will open the Add SSL Certificate page.
6. Enter a name your team will recognize in the Name field.
7. Enter your certificate in the Public Key field.
8. Enter your private key in the Private Key field.
9. (Optional.) Enter your certificate chain in the Certificate Chain (optional) field.
10. Click the Add SSL Certificate button.

CloudCannon will add the certificate and open its page. To use it, select it from the Uploaded SSL certificate dropdown in the HTTPS for [Subdomain] modal of each Subdomain it covers.

Review an uploaded certificate#

To see which Subdomains use a certificate and when it expires, click the certificate on the SSL Certificates page under Org Settings. The page for the certificate shows:

• Its status, next to its name, and the date it expires.
• The domains the certificate covers. CloudCannon reads these from the certificate, so certificates uploaded before it recorded them don't show this line.
• The Domains list, with each Subdomain that serves HTTPS with the certificate, including each Redirect Subdomain. Click a Subdomain to open its page.

The Domains list only shows Subdomains on Base Domains you can view.

Each certificate shows one of these statuses, on the SSL Certificates page and on its own page:

• Valid means the certificate expires in more than 30 days.
• Expires soon means the certificate expires within 30 days. CloudCannon cannot renew an SSL Certificate you upload, so upload a new one and select it for each Subdomain in the Domains list before then.
• Expired means the certificate has expired. CloudCannon switches any Subdomain still using it to the Let CloudCannon issue and renew it option.
• Renews automatically means CloudCannon renews the certificate itself.
• Removing means you removed the certificate while Subdomains still use it. HTTPS stays on while each one switches, and CloudCannon deletes the certificate once each has its own.

Remove an uploaded certificate#

Removing a certificate deletes it from CloudCannon, and you cannot recover it. Every Subdomain that uses the certificate switches to the Let CloudCannon issue and renew it option, including Subdomains on Base Domains you can't view, which the Domains list doesn't show.

If no Subdomain uses the certificate, or it has expired, CloudCannon deletes it straight away. Otherwise, HTTPS stays on while each Subdomain switches to a certificate CloudCannon issues. Until then, the certificate shows the Removing status, and you can't select it in the HTTPS for [Subdomain] modal. CloudCannon deletes it once every Subdomain has its own certificate, when it expires, or when CloudCannon stops retrying a certificate it can't issue, whichever comes first.

To remove an uploaded certificate:

1. Log in to CloudCannon.
2. Select the Organization that has the certificate.
3. Click the Org Settings link in the App Sidebar. CloudCannon will open the Details page.
4. Click the SSL Certificates link under the Hosting heading. CloudCannon will open the SSL Certificates page.
5. Click the Card for the certificate you want to remove. CloudCannon will open the page for that certificate.
6. Click the Remove SSL Certificate button in the Remove section. CloudCannon will open the Remove this SSL certificate? modal.
7. Click the Remove SSL Certificate button in the modal.

If no Subdomain uses the certificate, or it has expired, CloudCannon will delete it and return you to the SSL Certificates page. Otherwise, CloudCannon will mark the certificate Removing, and its page will list the Subdomains still using it until CloudCannon issues their own certificates.