Home / Docs / Server SSL install guide (Load Balancer / SLB)

Server SSL install guide (Load Balancer / SLB)

From CSR to creating the certificate in the console, listener rules and backup.

Server SSL install guide (Load Balancer / SLB)

Deploying the certificate on a load balancer (e.g. Alibaba Cloud SLB) offloads TLS at the edge, so backend servers need no certificate of their own.

1. Generate a CSR

openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key server.key -out server.csr

Submit server.csr for issuance and back up server.key for later upload; do not delete server.key before the issuance email arrives.

2. Install the certificate

a. Assemble the certificate

Copy the server certificate (from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----) into a text editor; right after it (new line, no blank line) paste the first intermediate CA certificate from the email, and save as server.pem.

b. Create the certificate in the SLB console

  1. Sign in to Alibaba Cloud, open the SLB console, choose Create Certificate.
  2. Certificate name: your own, e.g. SSLserver.
  3. Certificate content: paste the full text of server.pem.
  4. Private key: paste the full text of server.key.
  5. Region: the same region as the SLB instance.

c. Add the listener rule

Configure a forwarding listener on the SLB instance: protocol HTTPS, port 443; backend protocol HTTP, port 80 (match your backend); certificate = the one you created. Save to finish.

3. Backup & restore

Back up server.key and server.pem. To restore, recreate the certificate in the SLB console and bind the listener rule.

← Docs