SSL/TLS

SSL/TLS settings are on the SSL/TLS tab of a site's detail page (/cdn/domains/<domain>/ssl). HTTPS on the CDN involves two connections:

• Visitor ↔ edge: uses the edge certificate deployed for each hostname. This is either a free automatic certificate or one you upload.
• Edge ↔ origin: the encryption mode and the hostname's origin protocol decide whether this connection is encrypted and whether the origin certificate is validated.

#Deploying edge certificates

The Edge certificate management table lists every hostname on the site with its SSL status, issuer and expiry date. Click Manage certificates to open the certificate dialog. There are three ways to add a certificate.

#Option 1: Free automatic certificate (Let's Encrypt)

1. Make sure the hostname's DNS already points to the CDN, through CNAME or nameserver setup. Validation uses HTTP-01, so the edge must be able to answer Let's Encrypt's validation request.
2. On the Automatic certificate tab, click HTTP-01 validation.
3. The dialog shows progress through three stages: Pending, Verifying domain, Issuing certificate. When it finishes, the status becomes Issued. If it fails, Certificate request failed appears with the reason.

Automatic certificates are valid for 90 days. They are renewed and redeployed to the edge automatically before they expire, so you have nothing to do. Once a certificate exists, the button reads Renew certificate, which you can use to renew early.

#Option 2: Upload a custom certificate

1. Switch to the Custom certificate tab.
2. Paste the certificate into Certificate (PEM format). Include the full chain: your server certificate first, then the intermediates.
3. Paste the matching private key into Private key (PEM format).
4. Click Upload certificate. The status changes to Custom certificate.

Custom certificates are not renewed automatically. Upload a new one before the current one expires.

#Option 3: Deploy from the certificate library

If you bought or stored certificates in the Yeap Cloud SSL certificate service, you can pick one on the Certificate folder tab. It lists the certificates that match the hostname, including wildcard certificates that cover it. Select one to deploy it.

#Encryption mode (edge to origin)

In the SSL/TLS encryption mode card, choose a mode and click Save:

How the mode interacts with other settings:

• The table applies to hostnames whose origin protocol is Automatic. If you set the origin protocol to HTTP or HTTPS explicitly on the Origin tab, the protocol wins. Full (strict) validates the certificate only when the edge connects to the origin over HTTPS.
• Whether visitors can reach the edge over HTTPS depends only on whether the hostname has an edge certificate. The encryption mode does not change it.
• Switching to Off or Flexible asks for confirmation, because traffic between the edge and your origin will no longer be encrypted.
• In Full (strict), requests to the origin fail if the origin certificate is invalid, expired or does not match the domain.
• HTTP/2 to the origin needs an HTTPS origin connection, so in Off and Flexible modes the edge falls back to HTTP/1.1.

#Force HTTPS

Turn on Force HTTPS in the HTTPS settings card to redirect every HTTP request to the same URL over HTTPS with a 301. This controls how visitors connect. It does not change the origin protocol.

Before you turn it on, make sure every hostname on the site has a valid edge certificate. Otherwise visitors will see certificate errors.

#HSTS and security headers

The settings in the HSTS & security response headers card are added by the edge to responses sent to visitors. After you change them, click Save in the card's top-right corner.

#HSTS (HTTP Strict Transport Security)

#Other security headers

• X-Frame-Options: SAMEORIGIN or DENY, to prevent clickjacking.
• Referrer-Policy: pick a policy from the list.
• X-Content-Type-Options: nosniff: stops browsers from MIME sniffing.
• Content-Security-Policy (CSP): enter a complete policy. Leave it empty to send no CSP header.

These four headers only take effect when the Security response headers toggle is on.

#CORS and custom headers

• CORS (Cross-Origin Resource Sharing) lets you set:

  • Allowed origins, one per line, with * meaning any origin
  • Allowed methods
  • Allowed request headers
  • Exposed response headers
  • Whether credentials are allowed
  • The preflight max-age

  Credentials cannot be allowed together with the origin *.

• Custom response headers: set overrides a header of the same name, add appends a value (repeatable), and remove deletes a header such as X-Powered-By.

#Origin CA certificates

Origin CA certificates are issued by the platform and installed on your origin server to encrypt the connection from the edge to your origin. Only Yeap Cloud CDN uses them, and browsers do not trust them, so never use one as a visitor-facing certificate.

To issue one:

1. In the Origin CA certificate card, click Issue certificate.
2. Fill in the dialog:
   • Domains (SANs): defaults to example.com and *.example.com.
   • Key type: ECC P-256 (recommended), RSA 2048 or RSA 4096.
   • Validity: 7 days to 15 years. The default is 15 years.
3. Copy and store the certificate and private key right away. The private key is shown only once. You cannot view it again after closing the dialog.
4. Install the certificate and key in your origin's web server.
5. Set the site's encryption mode to Full.

If you need the CA chain on your origin, click Download CA root certificate. From the certificate list you can view, revoke and delete certificates.

#Related

• Hostnames and origin protocol: Add a site
• Override HTTPS redirects or origin encryption for specific paths: Page rules