Install and renew

Once your certificate is issued you need to deploy it on your web server or CDN and renew it before it expires. This page covers the My Certificates page, how to get the certificate files, and common ways to deploy them.

#The My Certificates page

Open Certificates (证书服务) → My Certificates (我的证书) (/ssl/certificates). The list has these columns:

Details (详情) shows the primary domain, SAN names, issuer, serial number, issue and expiry dates and the SHA-256 fingerprint.

#Getting the certificate files

• Download (下载) in the list: appears once the certificate is issued and downloads the certificate itself as <domain>.crt (PEM).
• The full bundle: the certificate, private key and CA intermediate chain can be retrieved in one call through the API (Active certificates only):

curl -X POST https://api.yeap.cloud/api/user/ssl/orders/download \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"order_id": 123}'

The response fields certificate, ca_bundle and private_key contain the certificate, the CA intermediate chain and the private key in PEM format. For issued orders, the order detail page at /ssl/order/<order_id> also has a Download certificate (下载证书) button that saves <domain>.crt, <domain>.key and <domain>-ca-bundle.crt.

#Deploying on a web server

Most servers expect a full chain: your certificate first, followed by the CA intermediates. Combine them with:

cat example.com.crt example.com-ca-bundle.crt > example.com.fullchain.pem

If you don't have the intermediates, the Chain Completion tool in SSL tools can build the full chain for you.

#Nginx

server {
    listen 443 ssl;
    http2 on;
    server_name example.com;

    ssl_certificate     /etc/ssl/example.com.fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
}

Run nginx -t to check the configuration, then nginx -s reload.

#Apache

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/example.com.fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example.com.key
</VirtualHost>

Apache 2.4.8 and later accept a full-chain file in SSLCertificateFile.

#PFX/PKCS#12 (IIS, Tomcat and others)

Files are provided in PEM format. Convert them locally with OpenSSL:

openssl pkcs12 -export -out example.com.pfx \
  -inkey example.com.key -in example.com.crt -certfile example.com-ca-bundle.crt

#Deploying on Yeap Cloud CDN

If the site is on Yeap Cloud CDN, upload the certificate and private key (PEM) for a hostname on the CDN domain's SSL settings page (/cdn/domains/<domain>/ssl). The CDN can also issue and renew free certificates for your hostnames automatically; see the CDN docs.

#Verifying the deployment

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

You can also paste the served certificate into the Certificate Decoder in SSL tools to check its validity and SAN names. If the server reports a key mismatch, use the Key Matcher to confirm the certificate and key belong together.

#Renewal

Certificates must be renewed before they expire. DV certificates (Let's Encrypt, ZeroSSL) are valid for 90 days; paid OV/EV certificates are typically valid for one year. The list flags certificates as expiring soon in their last 30 days.

Under My Certificates, Active and Expired certificates show a Renew (续期) button. Confirm the prompt and a renewal order linked to the original order is created ("Renewal order created"):

• Free DV certificates: the renewal order needs no payment. Submit the domain and complete validation again as described in Order and validate a certificate.
• Paid certificates: the renewal order must be paid before it can proceed. Contact us if you need help completing a paid renewal, or buy a new certificate from the catalog to replace the old one.

You can also start a renewal through the API:

curl -X POST https://api.yeap.cloud/api/user/ssl/certificates/renew \
  -H "Authorization: Bearer <token>" -H "Content-Type: application/json" \
  -d '{"order_id": 123}'

When the renewed certificate is issued, replace the old files on your server and reload the service.

#Uploading an existing certificate

If you bought a certificate from another CA, click Upload certificate (上传证书) and enter the primary domain, the certificate (PEM), the private key (PEM) and optionally the CA bundle. It is then kept under My Certificates alongside your other certificates. The platform checks the format and reads the issuer and expiry date automatically.

#Deleting a certificate

Click Delete (删除) and confirm. Deletion cannot be undone. Uploaded certificates can be deleted at any time; purchased certificates cannot be deleted while they are Active.

#Reissue and revocation

If a private key has been compromised, you need to change the domain, or you need a certificate revoked, contact us with the order ID and we will handle it with the CA.