Installing TLS Certificates

TLS certificates (updated, more secure, version of SSL) are necessary to enable secure HTTPS connections between a browser and your application. These certificates can be bought online, or generated by Clever Cloud. In that case, we manage the whole process for you.

There is two ways to get HTTPS for your apps:

Let’s Encrypt: Provided by default by Clever Cloud. Free. Nothing to configure.
Your own certificates: If you already have a certificate, you can upload it securely.

Getting Certificates with Let’s Encrypt

We automatically generate certificates when you add a domain name to your app. It’s all you have to do, our internal certificate generator will create a TLS certificate for a domain or a sub-domain.

We do not support wildcard Let’s Encrypt certificates at the moment. If you need a wildcard certificate, you can either generate a Let’s Encrypt certificate yourself or buy one (we can resell one to you, in which case we will deal with the csr generation ourselves, contact the support to know more).

Cloudflare configuration

If you use Cloudflare to manage your domain, the certificate generation could fail depending on your SSL/TLS settings, you will encounter 502 HTTP errors if Cloudflare expects SSL/TLS strict mode and automatically redirects to HTTPS.

To prevent this from happening you can create a page rule to bypass this policy as Let’s Encrypt needs to access the route /.well-known/acme-challenge* via HTTP to generate the certificate:

Define a page rule

We also recommend to disable the cache level.

Turn off HTTP to HTTPS redirection on Cloudflare

You can enable Force HTTPS in the information tab of your Clever Cloud application instead.

💡

If Let’s Encrypt fails to generate the certificate, you can test that the acme-challenge url works by running the command below:

$ curl http://<your-domain>/.well-known/acme-challenge/test
test

It should return a HTTP 200 OK with the string “test” as the body. If it does not, check your Cloudflare configuration.

Uploading my own certificates

You can upload certificates yourself: https://api.clever-cloud.com/v2/certificates/new ↗

Prerequisites

You need to paste a PEM bundle containing (in this order):

the private key
the certificate itself
intermediate certificates (optionnal)

⚠️

Only certificates with RSA 2048 and RSA 4096 keys are supported.
ECDSA certificates are not currently handled.

You should create a file.pem containing:

file.pem
-----BEGIN PRIVATE KEY-----
<the private key>
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
<the certificate>
-----END CERTIFICATE-----

Remove any possible mention of the algorithm in the footer and header. For instance, the API does not parse -----BEGIN RSA PRIVATE KEY-----, remove the RSA part.

You can add optionnal intermediate certificates by appending them to the file as

-----BEGIN CERTIFICATE-----
<the certificate>
-----END CERTIFICATE-----

You should note that `.pem`` files use the unix way of terminating lines with a single line feed character. Make sure your text editor does the same.

Certificate Submission Checklist

You .pem file must be correctly formatted to successfully upload your certificate. This checklist might help you troubleshoot uncesuccessful certificate submission.

Certificate Specifications
✅ The private key is included
✅ Keys lenght are RSA and either 2048 or 4096
✅ ECDSA is not used to create your certificate
✅ The line feed (LF) characters at the end
✅ The certificate chain include your certificate together with all the intermediary CA certificates that signed it, in that order

Sending Certificates Manually

👎

You should be aware that sending certificates manually is NOT RECOMMENDED.
Prefer another method, such as the certificate generation integrated into Let’s Encrypt, or using our certificate upload tool ↗.
If you have no other choice, then do not send these files by a means that is not secure. The integrity of your certificate will no longer be guaranteed.

In the event that you request the installation of a certificate by the support team, this operation will be charged on a one-off basis for each request. Please contact us for installation rates.

Sharing Certificates via Keybase

Another way to transmit your certificates is Keybase.
Keybase is an encrypted social networking service providing a key directory that maps social media identities to encryption keys (including, but not limited to PGP keys) in a publicly auditable manner. Additionally it offers an end-to-end encrypted chat, you can use to share sensitive informations, such as SSL/TLS certificates.

If your are a Keybase.io user, you can find us at keybase.io/clevercloud.

Sharing Certificates via GPG

Email can be a secure way to transfer your certificates when using a signed and encrypted email with GPG. Our dedicated email for receiving certificates is ssl@clever-cloud.com.

fingerprint: 03943517934C1FA5ED4E2F61218B86BD5278470F
64-bit: 218B86BD5278470F

Last updated on February 21, 2024

Did this documentation help you ?

Encryption at rest Logs management