App Certificate

SSL certificates are essential for protecting data transmission between websites and users, preventing data from being intercepted or tampered with by third parties. On your application’s SSL page, you can grant a global certificate for the entire application or add a specific SSL certificate by clicking the Add Certificate button.

# Adding an Application Certificate

You can add an SSL certificate to your application by following these steps:

1. Click the Add Certificate button.

1. Choose the certificate addition method:

   • Manual Upload: Upload your existing SSL private key and server certificate
   • Let’s Encrypt: Apply online for a free certificate issued by Let’s Encrypt
   • Generic ACME Issuer: Generate a certificate using other certificate issuers compliant with the ACME protocol
   • Global Certificate: Use a global certificate already configured in the system

2. Configure client certificate requirements:

   • Yes: Enforce client certificate requirement
   • No: Do not require a client certificate
   • Optional: Flexibly control through the “Enable SSL Client Verify” action in page rules

3. Set whether to make this certificate the default. The system will use the default certificate when a request cannot be matched to a specific certificate.

# Manually Uploading a Certificate

When choosing to upload an existing certificate manually, you can:

• PEM: Upload the private key and certificate files directly, or paste their contents. You can upload the CA certificate chain and server certificate separately or combine them in the Server Certificate field.
• PKCS#12: Select the PKCS12 type and upload a .p12 or .pfx file. The file must contain the server certificate and its matching private key and can also include the complete certificate chain. If the file is password-protected, enter its password as well. After upload, OpenResty Edge converts the certificate and private key to PEM format for storage.

# Automatically Issuing Certificates Using Let’s Encrypt

Before using this method, please ensure your domain DNS is correctly resolved and points to your Edge Node gateway server.

# Automatically Issuing Certificates Using Other ACME Issuers

Before using this method, you need to:

1. Ensure that your domain DNS is correctly resolved and points to your Edge Node gateway server.
2. Add information about certificate issuers such as ZeroSSL in the OpenResty Edge system.

# Using an External DNS Provider for DNS-01 Validation

When issuing a TLS certificate through Let’s Encrypt or another certificate issuer that supports the ACME protocol, you can specify an external DNS provider to validate domain ownership through DNS-01.

You can use an external DNS provider for DNS-01 validation in either of the following scenarios:

• The domain’s DNS records do not point to the OpenResty Edge Node. For example, the domain’s authoritative DNS is hosted by a public DNS provider and points to another server.
• The OpenResty Edge Node is not exposed to the public internet, so the certificate issuer cannot reach it over HTTP.

Before using this feature, create a DNS provider in Global Config and enter its credentials. When adding a Let’s Encrypt or Generic ACME certificate, select the external provider that hosts the domain’s DNS from DNS Provider. OpenResty Edge uses the provider’s API to create the _acme-challenge TXT record required for DNS-01 validation in the authoritative DNS zone. After validation, the certificate is automatically issued and deployed. You do not need to migrate the domain’s DNS to OpenResty Edge or expose the Edge Node to the public internet.

Make sure that:

• The selected certificate issuer supports DNS-01 validation.
• The DNS provider credentials have permission to modify records in the corresponding DNS zone.
• OpenResty Edge Admin can access the APIs of the DNS provider and certificate issuer.

During automatic renewal, OpenResty Edge performs DNS-01 validation again through the selected DNS provider. Keep the authorization credentials valid.

# Referencing Global Certificates

To reference a global certificate, follow these steps:

1. First, create a global certificate.
2. Assuming the application’s domain is test.com, select the global certificate *.test.com from the certificate dropdown list.
3. Note: The certificate’s domain must match or cover the application’s domain. Otherwise, certificate validation will fail.

# Configuring Multiple ACME Certificates for the Same Domain

By default, OpenResty Edge only allows adding one ACME certificate for a domain. If you need to set up multiple ACME certificates for the same domain, follow these steps:

1. Edit the configuration file: /usr/local/oredge-admin/conf/config.ini
2. Add or modify the following configuration:

[acme]
acme_skip_duplicate_check = true

By setting acme_skip_duplicate_check = true, the system will allow multiple ACME certificates to be configured for the same domain.

1. Restart the service to apply the configuration:

sudo systemctl start upgrade-oredge-admin

With these settings, you can flexibly manage SSL certificates for your applications, enhancing website security and credibility.