SSL certificates

This guide explains how to deploy an SSL certificate on Shared Hosting so your site can be served over HTTPS.

#How it works

Shared Hosting uses a global SSL certificate: each hosting account has one certificate, and once uploaded it applies to every domain bound to that account. So the certificate must cover every domain you want served over HTTPS. You can use either of these:

• A multi-domain certificate that lists every domain in its Subject Alternative Names (SAN), for example both example.com and www.example.com.
• A wildcard certificate such as *.example.com. A wildcard doesn't cover the bare domain example.com, so include that in the SAN separately.

At the time of writing, every Shared Hosting plan supports SSL certificates.

#Preparing the certificate files

You need two pieces of PEM-formatted text:

#Converting common formats

The form rejects a private key that starts with -----BEGIN EC PRIVATE KEY----- (common for ECC certificates) or one that has a passphrase. Convert it to unencrypted PKCS#8 with OpenSSL first:

openssl pkcs8 -topk8 -nocrypt -in original.key -out private.key

If you have a .pfx or .p12 file, split it like this:

openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
openssl pkcs12 -in cert.pfx -cacerts -nokeys -out chain.pem
openssl pkcs12 -in cert.pfx -nocerts -nodes -out original.key
openssl pkcs8 -topk8 -nocrypt -in original.key -out private.key
cat cert.pem chain.pem > fullchain.pem

#Checking before you upload

The server checks that the certificate and private key match. You can check this yourself first:

# Show the domains and expiry date in the certificate
openssl x509 -in fullchain.pem -noout -subject -enddate -ext subjectAltName

# If these two commands print the same hash, the certificate and key match
openssl x509 -in fullchain.pem -noout -pubkey | openssl sha256
openssl pkey -in private.key -pubout | openssl sha256

#Deploying the certificate

1. In the 主机 (Hosting) → 共享主机 (Shared Hosting) list, click 管理 (Manage) on the hosting account.
2. Switch to the SSL证书 (SSL certificate) tab and click 上传SSL证书 (Upload SSL certificate).
3. Paste the full chain into SSL证书 (Certificate) and the private key into 私钥 (Private Key).
4. Click 上传 (Upload). When you see "SSL证书上传成功" (SSL certificate uploaded), the certificate is deployed.

If you get an error, these are the usual causes:

#Verifying HTTPS

Once the certificate is deployed, open https://your-domain in a browser and check that the address bar shows a secure connection. You can also check the certificate the server returns from the command line:

openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -enddate

#Redirecting to HTTPS

After you deploy a certificate, your site accepts both HTTP and HTTPS. To make visitors always use HTTPS, add a redirect in your application. For a PHP site, put this at the top of the entry file:

<?php
$isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
    || (isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 443);
if (!$isHttps) {
    header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'], true, 301);
    exit;
}

Before you add the redirect, check that HTTPS works. For WordPress and similar applications, you also need to change the site address in the admin panel to one that starts with https://.

#Renewal

Certificates on Shared Hosting don't renew automatically. Before your certificate expires, get a new one from your certificate authority and upload it again on the SSL证书 (SSL certificate) tab. The new certificate replaces the old one. Aim to replace it at least two weeks before it expires.

#Deploying through the API

This is the endpoint the console uses. {name} is the hosting account name (the same as the database username). Send your login token with the request:

jq -n --rawfile cert fullchain.pem --rawfile key private.key \
  '{certificate: $cert, certificate_key: $key}' \
| curl -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
    https://api.yeap.cloud/api/user/host_shared/vhosts/name/{name}/ssl-full -d @-

Building the request body with jq keeps the line breaks in the PEM text intact.