SSL/TLS

SSL/TLS settings are on the SSL/TLS tab of a site's detail page (/cdn/domains/<domain>/ssl). HTTPS on the CDN involves two connections:

• Visitor ↔ edge: uses the edge certificate deployed for each hostname. This is either a free automatic certificate or one you upload.
• Edge ↔ origin: the encryption mode and the hostname's origin protocol decide whether this connection is encrypted and whether the origin certificate is validated.

#Deploying edge certificates

The 边缘证书管理 (Edge certificates) table lists every hostname on the site with its SSL status, issuer and expiry date. Click 管理证书 (Manage certificate) to open the certificate dialog. There are three ways to add a certificate.

#Option 1: Free automatic certificate (Let's Encrypt)

1. Make sure the hostname's DNS already points to the CDN, through CNAME or nameserver setup. Validation uses HTTP-01, so the edge must be able to answer Let's Encrypt's validation request.
2. On the 自动证书 (Let's Encrypt) tab, click HTTP-01 验证 (HTTP-01 validation).
3. The dialog shows progress through three stages: 等待处理 (queued), 域名验证中 (validating), 证书签发中 (issuing). When it finishes, the status becomes 已签发 (Issued). If it fails, 证书申请失败 (Request failed) appears with the reason.

Automatic certificates are valid for 90 days. They are renewed and redeployed to the edge automatically before they expire, so you have nothing to do. Once a certificate exists, the button reads 续费证书 (Renew certificate), which you can use to renew early.

#Option 2: Upload a custom certificate

1. Switch to the 自定义证书 (Custom certificate) tab.
2. Paste the certificate into 证书 (PEM格式) (Certificate, PEM). Include the full chain: your server certificate first, then the intermediates.
3. Paste the matching private key into 私钥 (PEM格式) (Private key, PEM).
4. Click 上传证书 (Upload certificate). The status changes to 自定义证书 (Custom certificate).

Custom certificates are not renewed automatically. Upload a new one before the current one expires.

#Option 3: Deploy from the certificate library

If you bought or stored certificates in the Yeap Cloud SSL certificate service, you can pick one on the 证书夹 (Certificate library) tab. It lists the certificates that match the hostname, including wildcard certificates that cover it. Select one to deploy it.

#Encryption mode (edge to origin)

In the SSL/TLS 加密模式 (Encryption mode) card, choose a mode and click 保存 (Save):

How the mode interacts with other settings:

• The table applies to hostnames whose origin protocol is 自动 (Auto). If you set the origin protocol to HTTP or HTTPS explicitly on the Origin tab, the protocol wins. Full (strict) validates the certificate only when the edge connects to the origin over HTTPS.
• Whether visitors can reach the edge over HTTPS depends only on whether the hostname has an edge certificate. The encryption mode does not change it.
• Switching to Off or Flexible asks for confirmation, because traffic between the edge and your origin will no longer be encrypted.
• In Full (strict), requests to the origin fail if the origin certificate is invalid, expired or does not match the domain.
• HTTP/2 to the origin needs an HTTPS origin connection, so in Off and Flexible modes the edge falls back to HTTP/1.1.

#Force HTTPS

Turn on 强制 HTTPS (Force HTTPS) in the HTTPS 设置 (HTTPS settings) card to redirect every HTTP request to the same URL over HTTPS with a 301. This controls how visitors connect. It does not change the origin protocol.

Before you turn it on, make sure every hostname on the site has a valid edge certificate. Otherwise visitors will see certificate errors.

#HSTS and security headers

The settings in the HSTS 与安全响应头 (HSTS and security headers) card are added by the edge to responses sent to visitors. After you change them, click 保存 (Save) in the card's top-right corner.

#HSTS (HTTP Strict Transport Security)

#Other security headers

• X-Frame-Options: SAMEORIGIN or DENY, to prevent clickjacking.
• Referrer-Policy: pick a policy from the list.
• X-Content-Type-Options: nosniff: stops browsers from MIME sniffing.
• Content-Security-Policy (CSP): enter a complete policy. Leave it empty to send no CSP header.

These four headers only take effect when the 安全响应头 (Security headers) toggle is on.

#CORS and custom headers

• CORS（跨域资源共享） (CORS) lets you set:

  • Allowed origins, one per line, with * meaning any origin
  • Allowed methods
  • Allowed request headers
  • Exposed response headers
  • Whether credentials are allowed
  • The preflight max-age

  Credentials cannot be allowed together with the origin *.

• 自定义响应头 (Custom response headers): set overrides a header of the same name, add appends a value (repeatable), and remove deletes a header such as X-Powered-By.

#Origin CA certificates

Origin CA certificates are issued by the platform and installed on your origin server to encrypt the connection from the edge to your origin. Only Yeap Cloud CDN uses them, and browsers do not trust them, so never use one as a visitor-facing certificate.

To issue one:

1. In the Origin CA 证书 (Origin CA certificates) card, click 签发证书 (Issue certificate).
2. Fill in the dialog:
   • 域名 (SANs) (Hostnames): defaults to example.com and *.example.com.
   • 密钥类型 (Key type): ECC P-256 (recommended), RSA 2048 or RSA 4096.
   • 有效期 (Validity): 7 days to 15 years. The default is 15 years.
3. Copy and store the certificate and private key right away. The private key is shown only once. You cannot view it again after closing the dialog.
4. Install the certificate and key in your origin's web server.
5. Set the site's encryption mode to 完全 (Full).

If you need the CA chain on your origin, click 下载 CA 根证书 (Download CA root certificate). From the certificate list you can view, revoke and delete certificates.

#Related

• Hostnames and origin protocol: Add a site
• Override HTTPS redirects or origin encryption for specific paths: Page rules