Custom SSL via SLB

Custom SSL via Shared Load Balancer (SLB)

Custom SSL via Shared Load Balancer allows a custom domain to use its own SSL certificate even when the target environment does not have a public IP address.

The available SSL method depends on the environment topology and the domain that must be protected.

Environment with Public IP Use Let’s Encrypt SSL or Custom SSL to protect domains connected directly through the public entry point.
Base Environment Domain Use Built-In SSL to protect the platform-provided domain of an environment without a public IP.
Custom Domain without Public IP Use Custom SSL via SLB to secure the domain through the Shared Load Balancer.
This solution is mainly intended for platform installations on Azure or Google infrastructure where additional external IP addresses may not be available.
On this page

How Custom SSL via SLB Works

The feature removes the requirement to attach an external public IP to the environment entry point before using a custom SSL certificate.

Upload Certificate Data → Store in Platform Database → Synchronize Across SLB Cluster → Bind Certificate to Custom Domain
  • Upload the private key.
  • Upload the domain certificate.
  • Optionally upload the intermediate certificate.
  • The platform stores the certificate data in its database.
  • The data is synchronized across the Shared Load Balancer cluster.
  • The certificate is selected for the requested custom domain through SNI.

SNI Certificate Selection

Server Name Indication (SNI) is an extension of the TLS protocol. It allows the client to send the requested domain name during connection establishment.

The Shared Load Balancer uses this domain information to return the correct certificate, even when several domains and certificates share the same load-balancing infrastructure.

Client compatibility: The connecting browser or client must support SNI so the Shared Load Balancer can choose the correct custom-domain certificate.

Available API Methods

The documented configuration is currently performed through API methods.

API Method Parameters Purpose
GetSSLCerts session, [ids] Lists all certificates owned by the current user, or only certificates specified through the optional IDs parameter.
AddSSLCert session, key, cert, [interm] Uploads a private key, domain certificate, and optional intermediate certificate. Values can be provided through links or in the request body.
EditSSLCert session, id, [key], [cert], [interm] Updates an existing certificate. Use *, null, or none as the intermediate value to remove the intermediate certificate.
RemoveSSLCerts session, ids Removes selected certificates. Use * to select all. A certificate that is still assigned must be unbound first.
BindSSLCert session, envName, certId, [entryPoint], [extDomains] Binds a certificate to an environment or, when SLB is selected as the entry point, binds it to the listed external domains on the Shared Load Balancer.
UnbindSSLCert session, envName, [extDomains] Unbinds a certificate from an environment or from the listed custom domains on the Shared Load Balancer.
BindExtDomains session, envName, extDomains, [certId] Binds custom domains to an environment and installs the selected certificate on the Shared Load Balancer when certId is supplied.
GetExtDomains session, envName Lists the custom domains currently attached to the environment.

Configuration Workflow

1Upload the certificate

Use AddSSLCert to upload the private key, domain certificate, and optional intermediate certificate to the platform database.

2Bind the custom domain

Use BindExtDomains when attaching a new custom domain and certificate together.

3Bind a certificate to an existing domain

Use BindSSLCert when the custom domain is already attached to the environment.

4Verify the binding

Use GetExtDomains and GetSSLCerts to review the attached domains and uploaded certificates.

To remove a certificate, unbind it from the relevant environment or domains first and then call RemoveSSLCerts.

Certificate Quota

The number of custom SSL certificates attached through the Shared Load Balancer is limited per account by the slb.customssl.maxcount quota.

  • Billing account default: 50 certificates.
  • Trial account default: 5 certificates.
Quota protection: The certificate limit is used to prevent abuse. The actual value can differ according to the hosting provider and account type.

What’s next?