Put Your Website Behind Yeap CDN with Free HTTPS in 10 Minutes

This tutorial shows how to put an existing website behind Yeap CDN and turn on free HTTPS. It assumes you already have a reachable origin (any server reachable over HTTP or HTTPS) and a domain whose DNS you can change. We will use www.example.com as the example.

Before you start

• A Yeap Cloud account; sign in at console.yeap.cloud.
• Your origin address: an IP or hostname, plus the protocol and port it listens on.
• Access to your domain's DNS: either the ability to add a CNAME record at your current DNS provider, or the ability to change nameservers at your registrar.

Step 1: Add the domain (about 2 minutes)

In the console, go to CDN → Domains and click to add a domain. This opens the setup wizard (at /cdn/domains/new), which has five steps: basic info, plan, connection method, origin settings and setup instructions.

Under Basic info, fill in:

• Domain: for example example.com;
• Line / group: the group of edge nodes you want to use;
• Enable SSL: on;
• the remaining options (WAF, HTTP version, WebSocket, proxy timeout) can stay at their defaults. You can change them later in the domain settings.

Under Plan, choose a CDN plan. The free plan is fine for trying things out; paid plans must be paid before you can continue.

Step 2: Choose a connection method (about 1 minute)

There are two options:

With the NS method, the platform automatically creates a DNS zone for your domain and writes the CNAME records the CDN needs. This tutorial uses the CNAME method.

Step 3: Configure the origin (about 2 minutes)

Under Origin settings, add an origin for each hostname you want to accelerate:

• Hostname: www.example.com;
• Origin address: your origin's IP or hostname;
• Protocol and port: what your origin actually listens on, for example HTTPS / 443;
• Load mode: if you have several origin addresses, how to balance between them;
• HTTP version, WebSocket and timeout can be adjusted as needed.

If your origin only speaks HTTP, choose HTTP here; the SSL mode section below explains what that implies.

Step 4: Add the CNAME record (about 2 minutes, plus DNS propagation)

After you save the origin, the wizard moves to Setup instructions and lists the CNAME target for each hostname. Copy it and add a record at your DNS provider:

www.example.com.   300   IN   CNAME   <CNAME target shown in the console>.

Then click DNS check on the instructions page to confirm the record is live. You can also check yourself:

dig +short CNAME www.example.com

Note that many DNS providers do not allow a CNAME on the apex (example.com itself). To accelerate the apex, use the NS method or your DNS provider's CNAME flattening feature.

Step 5: Get a free certificate (about 2 minutes)

Open the SSL tab on the domain's detail page (/cdn/domains/your-domain/ssl), click Manage certificate for the hostname, and under Automatic certificate (Let's Encrypt) click HTTP-01 validation.

HTTP-01 works like this: the certificate authority requests http://www.example.com/.well-known/acme-challenge/... to confirm that you control the domain. Because your domain already points at the CDN, the request reaches an edge node, which answers it directly. That is why you should finish step 4 and wait for DNS to take effect before requesting the certificate.

The page shows progress while the request runs (pending, verifying, issuing). Certificates are valid for 90 days and are renewed automatically before they expire; there is nothing for you to do. If you already have your own certificate, you can upload the PEM certificate and private key on the same page instead.

Step 6: Choose an SSL mode and force HTTPS (about 1 minute)

The certificate encrypts the browser-to-CDN leg. The CDN-to-origin leg is controlled by the SSL mode:

Full (strict) requires the origin certificate to be issued by a trusted CA and to match the hostname. The easiest way to get there is to install a Let's Encrypt certificate on the origin too. When you switch from a safer mode to Off or Flexible, the console warns you that this is a security downgrade.

Next, turn on Force HTTPS, and the edge redirects every HTTP request to HTTPS. Once everything works, you can enable HSTS on the same page so browsers use only HTTPS for a period of time (a common max-age is 31536000 seconds, one year). HSTS is hard to take back once browsers have seen it, so start with a short max-age, and only enable "include subdomains" and "preload" after confirming every subdomain supports HTTPS.

Step 7: Verify

# HTTP should redirect to HTTPS
curl -sI http://www.example.com/ | head -n 3

# HTTPS responds normally and carries a cache status header
curl -sI https://www.example.com/logo.png | grep -i -E "^HTTP|x-cache-status"

For a cacheable static asset, the first request is usually a MISS and a repeat request should show HIT. Dynamic pages may show BYPASS or MISS by default, which is expected.

Where to go next

• Tune cache lifetimes and the query-string mode on the Cache tab to raise your hit ratio;
• add access rules on the Firewall tab;
• enable compression and other performance features on the Optimization tab;
• watch traffic and troubleshoot on the Traffic and Diagnostics tabs.

The only real waiting in this whole process is DNS propagation. With a short TTL on your DNS records, you can go from adding the domain to working HTTPS in about ten minutes.