Custom SSL

Custom SSL Certificates

Custom SSL certificates protect application traffic by encrypting data exchanged between users and the application. This guide explains how to prepare certificate files, adjust the environment, configure the domain and upload the certificate.

The platform supports several certificate types, including self-signed, wildcard, multi-domain, extended-validation and domain-validated certificates.

In this article

Requirements

Custom Domain

A registered domain name that will be used to open the application.

Public IP

A public IP attached to the application server or certified load balancer.

Certificate Files

Server key, domain certificate and intermediate certificate or certificate chain.

Server KeyThe private key generated for the domain. It must not be protected with a passphrase.
Certificate RequestA CSR file generated from the server key and submitted to the Certificate Authority.
Domain CertificateThe certificate issued specifically for the domain.
Intermediate CertificateThe CA certificate or chain that connects the domain certificate to a trusted root authority.

Generate a Custom SSL Certificate

1

Purchase a domain

Register the required domain using a preferred domain registrar.

2

Generate a private server key

Use OpenSSL or another trusted certificate tool to create a private key for the selected domain.

Windows OpenSSL Command

genrsa -out server.key 4096

Linux, macOS or FreeBSD Command

openssl genrsa -out server.key 4096
!

Do not protect the server key with a passphrase.

A password-protected key may be rejected when uploaded to the platform.

Generate a private server key
Generate the private server key using OpenSSL.
3

Create the certificate signing request

Generate a CSR file using the newly created server key.

Windows CSR Command

req -config C:\path\to\openssl.cnf -new -key server.key -out server.csr

Linux, macOS or FreeBSD CSR Command

openssl req -new -key server.key -out server.csr
✓

Common Name

Enter the exact domain name that will use the certificate. A mismatched Common Name can prevent successful validation.

Generate certificate signing request
Complete the requested certificate details and generate the CSR file.
4

Submit the CSR to a Certificate Authority

Send the CSR file to the selected Certificate Authority for validation and signing.

5

Receive the certificate files

After validation, the Certificate Authority supplies the domain certificate and the required intermediate certificate or certificate chain.

Adjust the Environment Topology

The environment must have a custom domain and a public IP attached to its external entry point before a standard custom SSL certificate can be used.

i

Load balancer requirement

Environments based on .NET, Go, Node.js or custom containers may require a certified load balancer. In this case, attach the public IP to the load balancer because it becomes the environment entry point.

1

Open the environment topology

Create a new environment or select Change Environment Topology for an existing environment.

2

Review Custom SSL requirements

Open the SSL section and confirm that each listed requirement is marked as completed.

3

Enable missing requirements

Use the available enable option to let the platform adjust the topology automatically, then click Create or Apply.

Configure the Domain and A Record

1

Copy the public IP

Expand the application server or load balancer node and copy its public IP address.

Copy the environment public IP
Copy the public IP address from the environment topology.
2

Create the A Record

Open the DNS manager provided by the domain registrar and point the custom domain to the copied public IP address.

Type: A
Host: @ or required subdomain
Points to: Environment public IP
TTL: Registrar default or required value

Upload the Certificate to the Environment

1

Open environment settings

Click Settings for the configured environment.

Open environment settings
Open the settings of the target environment.
2

Open Custom SSL

Select Custom SSL from the settings menu.

3

Upload the required files

Upload the server key, intermediate certificate and domain certificate into their respective fields.

4

Save the configuration

Click Save. The relevant environment servers may restart automatically while the new SSL configuration is applied.

Upload custom SSL certificate files
Upload the server key, intermediate certificate and domain certificate.

Expected Result

After the server restart and DNS propagation are complete, open the application using the custom domain with the https:// protocol. The application should load securely without certificate warnings.

Application opened securely over HTTPS
The application opens through HTTPS using the uploaded Custom SSL certificate.

Important Notes

  • The server key and domain certificate must belong to the same certificate request.
  • The private key must not be passphrase-protected.
  • The certificate Common Name or Subject Alternative Name must match the application domain.
  • The domain must resolve to the environment’s public IP.
  • Certificate files must be valid, current and supplied in the format accepted by the platform.
  • Renew and replace the certificate before its expiry date.

What’s next?