Installing an SSL certificate based on an Acquia-generated CSR¶

To install an SSL certificate based on an Acquia-generated CSR, you can follow one of these methods based on the type of your SSL certificate:

• Legacy certificates
• Non-legacy certificates

Installing an SSL certificate not based on an Acquia-generated CSR¶

To install an SSL certificate not based on an Acquia-generated CSR:

1. Sign in to the Cloud Platform user interface as a user with the necessary permissions.
2. Select your organization, application, and environment, and then, in the left menu, click SSL.
3. On the SSL tab, click Install SSL certificate.
4. On the Install SSL certificate page, enter the following information about the certificate:

   1. If you want the certificate to use the legacy (ELB-based) SSL model, select Install legacy SSL certificate.

      Note

      • Installing a new certificate as the legacy certificate overwrites the certificate currently active on ELB as there can only be one legacy/ELB certificate in place at a time. For a summary of differences between standard and legacy SSL certificates, see Standard certificates.
      • The legacy method is unavailable in Site Factory and non-production environments.
   2. (Optional) In Label, enter a label to help you identify the certificate. If you selected Install legacy SSL certificate, the system does not display the Label field since you can only have a single legacy SSL certificate on an environment.

   3. In SSL Certificate, enter the SSL certificate in the PEM format. The certificate must look something like the following example, but much longer:

      -----BEGIN CERTIFICATE-----
      MIIFWzCCBEOgAwIG1bBouS1O/ob8scTviFvVCKVzzANBgkqhkiG9w0BAQsFADBw
      MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
      d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
      dXJhbmNlIFNlcnZlciBDQTAeFw0xNjA5MTUwMDAwMDBaFw0xNzEyMDgxMjAwMDBa
      MGYxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQ8wDQYDVQQH
      Us8/azXp7pJ75vyNi/tuLbLSQbwqNcEo+jBXPysGdA==
      -----END CERTIFICATE-----
      

   4. In SSL private key, enter the private key for this certificate in the PEM format.
   5. In CA intermediate certificates, enter the chain/intermediate certificates files in the PEM format and in the proper order. For more information, see Ensuring that certificates are in proper order.

5. Click Install.

   After the installation is complete, the system displays the CSR details in the SSL certificates section.

Deactivating an SSL certificate¶

You can deactivate an active SSL certificate at any time. If you are planning to remove an SSL certificate, Acquia recommends to first deactivate the certificate and then remove it.

To deactivate an SSL certificate, on the SSL page (under SSL certificates), locate the active certificate you want to deactivate, and then click Deactivate.

Revoking a certificate¶

If you need to delete or deactivate a valid SSL certificate, you must revoke that certificate to prevent an attacker’s website masquerading as your own. Acquia recommends that you deactivate or delete any revoked or expired certificates from all environments. Leaving a revoked certificate active in any environment may result in downtime for your application.

Each SSL certificate vendor has different procedures to perform a certificate revocation. Ensure you follow the instructions your SSL certificate vendor provides. Here are the procedures for two common vendors:

• Verisign: Revoke an ECA Certificate
• Digicert: EV SSL Certificate Revocation Requests

Renewing or replacing an SSL certificate¶

If you need to replace an SSL certificate that is expiring, you do not need to delete or remove your existing certificate(s). There are two options you can take to replace your SSL certificate: The first is to install an updated certificate that includes new information, such as additional domains/ organizational changes, etc. This option includes the same steps as if you were installing a brand new certificate. If this applies to you, follow the instructions on installing a certificate here.

The other option is to install a renewed version of your existing certificate that just has a new expiration date. If there is no change to the details of the certificate itself besides the expiry date, you may not need to generate a new CSR. To install the updated version of the same certificate, follow these steps:

To upload a new SSL certificate to a Cloud Platform subscription that already has an active SSL certificate:

1. Sign in to the Cloud Platform user interface as a user with the required permissions.
2. Select your organization, application, and environment.
3. In the left menu, click SSL.
4. Generate a new certificate signing request if there are any changes in your new SSL certificate, such as adding or removing domains.
5. If the CSR that was used to originally obtain your certificate is available and you generated your CSR using the Cloud Platform user interface:

   • On the SSL page, in the Certificate signing requests section, click Install to navigate to the installation form and have the private key prepopulated in its respective field.

     If you have questions on this step, see Generate private key in CSR for the CSR you used to obtain the SSL certificate you want to install.

6. If you don’t see the CSR that was used to originally obtain your certificate:

   • In the Certificate signing requests section, click View next to the preexisting certificate in the SSL certificates section to find the corresponding private key, as shown in the following screens:

     

7. Copy the private key to a local text editor before navigating to the installation form by clicking the Install SSL certificate button on your SSL page.

   Note

   Cloud Platform stores both the certificate signing request file (ssl.csr) and the private key (ssl.key) in the Cloud API.

8. Install the updated or renewed certificate.
9. Activate the updated or renewed certificate.