Information for:

# Managing SSL certificates¶

Using the Acquia Cloud Platform interface SSL page, you can perform the following tasks to manage an environment’s SSL certificates and CSRs:

## Installing an SSL certificate¶

After obtaining an SSL certificate for an environment, as described in Obtaining an SSL certificate, you can use the SSL page in the Acquia Cloud Platform interface to install the certificate on an environment. Depending on whether you use a CSR generated through the Acquia Cloud Platform interface or obtained the certificate through some other way, there are two methods to install an SSL certificate. If you are renewing or replacing an SSL certificate, see Renewing or replacing an SSL certificate.

You may want to confirm the validity of your SSL certificate before you upload or try to activate the certificate on Acquia Cloud Platform. For more information, see Verifying the validity of an SSL certificate on the Acquia Support Knowledge Base.

### Installing an SSL certificate based on an Acquia-generated CSR¶

To install an SSL certificate based on a CSR generated through the Acquia Cloud Platform interface, complete the following steps:

1. Sign in to the Cloud Platform user interface as a user with the necessary permissions.

2. Select your organization, application, and environment, and then, in the left menu, click SSL.

3. On the SSL page, click the Install link next to the CSR that you generated.

The private key pre-populates in its respective field and you can fill the remaining fields on the installation form. If you are unsure about how to find the private key associated with a CSR that was generated in the UI, see Generate private key in CSR.

4. On the Install SSL certificate page, enter the following information about the certificate:

• If you want the certificate to use the legacy (ELB-based) SSL model, select Install legacy SSL certificate.

Note

Installing a new certificate as legacy overwrites the certificate currently active on ELB as there can only be one Legacy/ELB certificate in place at a time. For a summary of some differences between standard SSL certificates and legacy SSL certificates, see Standard certificates. The legacy method isn’t available on Site Factory environments.

• Optionally, in the Label field, enter a label to help you identify the certificate in the Acquia Cloud Platform interface. If you selected Install legacy SSL certificate, there is no label field, since you can only have a single legacy SSL certificate on an environment.

• In the SSL certificate field, enter the main/server SSL certificate file in PEM format. PEM formatted files are text files written in Base64 ASCII encoding with plain-text headers and footers. The certificate must look something like the following example, but much longer:

-----BEGIN CERTIFICATE-----
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0xNjA5MTUwMDAwMDBaFw0xNzEyMDgxMjAwMDBa
MGYxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQ8wDQYDVQQH
Us8/azXp7pJ75vyNi/tuLbLSQbwqNcEo+jBXPysGdA==
-----END CERTIFICATE-----


Private key files must be unencrypted and non-password protected, or the certificate can’t be deployed.

• As noted, the Acquia Cloud Platform interface fills the SSL private key field with the private key for the certificate in PEM format. Don’t change this key.

• Enter the required intermediate certificates into the CA intermediate certificates field, in PEM format, and in the proper order. For more information, see Ensuring that certificates are in proper order.

5. Click Install.

### Installing an SSL certificate not based on an Acquia-generated CSR¶

To install an SSL certificate not based on an Acquia-generated CSR:

1. Sign in to the Cloud Platform user interface as a user with the necessary permissions.

2. Select your organization, application, and environment, and then, in the left menu, click SSL.

3. On the SSL page, click the Install SSL certificate button to install the SSL certificate.

4. On the Install SSL certificate page, enter the following information about the certificate:

• If you want the certificate to use the legacy (ELB-based) SSL model, select Install legacy SSL certificate.

Note

Installing a new certificate as legacy overwrites the certificate currently active on ELB as there can only be one Legacy/ELB certificate in place at a time.

• In the Label field, enter a label to help you identify the certificate in the Acquia Cloud Platform interface. If you selected Install legacy SSL certificate, there is no label field, since you can only have a single legacy SSL certificate on an environment.

• In the SSL certificate field, enter the SSL certificate in PEM format. The certificate must look something like the following example, but much longer:

-----BEGIN CERTIFICATE-----
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMS8wLQYDVQQDEyZEaWdpQ2VydCBTSEEyIEhpZ2ggQXNz
dXJhbmNlIFNlcnZlciBDQTAeFw0xNjA5MTUwMDAwMDBaFw0xNzEyMDgxMjAwMDBa
MGYxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQ8wDQYDVQQH
Us8/azXp7pJ75vyNi/tuLbLSQbwqNcEo+jBXPysGdA==
-----END CERTIFICATE-----

• In the SSL private key field, enter the private key for this certificate in PEM format.

• Enter the chain/intermediate certificate files in the CA intermediate certificates field in PEM format. CA intermediate certificates must be entered in the proper order. For more information, see Ensuring that certificates are in proper order.

5. Click Install.

Note

## Viewing an SSL certificate¶

After you have installed an SSL certificate on an environment, you can view it on the SSL page. The SSL certificates section lists all the installed certificates and their active status. Click View to see details about an SSL certificate, including:

• The certificate’s label (the name you identified the certificate with when you installed it)
• Whether the certificate is a legacy certificate
• The certificate’s active status
• The certificate’s expiration date
• The domains associated with the certificate
• The SSL certificate files

Click Show to view the PEM encoded certificate, CA chain (CA intermediate certificates), or private key. Legacy/ELB certificates will not have the private key visible on this View page in the UI.

## Activating an SSL certificate¶

Important

Acquia Cloud Platform supports the use of multiple active certificates on each environment. Acquia doesn’t recommend having more than 10 active certificates per environment at a time. This feature isn’t available on Acquia Cloud Platform Professional environments or Node.js applications. Also, this feature isn’t compatible with certificate pinning features provided by some CDN providers.

After installing an SSL certificate on an environment, you must activate the certificate before it starts working with HTTPS requests to the environment.

To activate an SSL certificate, on the SSL page (under SSL certificates) locate the certificate you want to activate, and then click Activate to confirm. The activation will take a few minutes to complete.

Note

• You must activate Standard (SNI) certificates before use.
• Legacy certificates installed on the Elastic Load Balancer (ELB) will instantly override the previous certificate on the ELB.
• You can have a single ELB/legacy certificate and one or more standard certificates active at the same time.
• Site Factory customers who are using this interface for the first time to replace certificates previously installed by Acquia must ensure that any newly installed self-service certificate covers all of the domains previously covered by the Acquia-installed certificate.

When multiple certificates are set to active, HTTPS requests for any given domain on your environment will be served using the newest activated certificate which includes that domain. If multiple certificates are active and cover the same domain, one with an exact match and one with a wildcard match, your environment will serve the certificate with the exact match, even if the wildcard certificate was installed more recently. If no matching certificates are found, your environment will default to using any default or custom certificate installed on that environment by Acquia.

### Deactivating an SSL certificate¶

You can deactivate an active SSL certificate at any time. If you are planning to remove an SSL certificate, Acquia recommends to first deactivate the certificate and then remove it.

To deactivate an SSL certificate, on the SSL page (under SSL certificates), locate the active certificate you want to deactivate, and then click Deactivate.

## Removing an SSL certificate¶

To avoid potential impact to your site(s), it is a best practice to keep your current certificate in place before removing it if you are replacing it with a new certificate.

You can delete a non-legacy SSL certificate in the Acquia Cloud Platform user interface at any time. Before doing so, you must deactivate the certificate itself.

Important

Removing certificates from Acquia Cloud Platform is a permanent action that can’t be undone. Acquia recommends you save any necessary SSL files locally before deleting them in the Acquia Cloud Platform user interface.

To remove a legacy/ELB SSL certificate, you must contact Acquia support. Removing a legacy SSL certificate includes permanently removing your ELB as well. This means that if you would like to install another legacy SSL certificate in the future, you would need to point your domains to a new ELB CNAME address.

Note

Before Acquia can remove a legacy SSL certificate, all your domains must be pointed away from the ELB CNAME.

To remove a non-legacy SSL certificate, complete the following steps:

2. Go to the application you want to change.
3. Select the environment from which you want to remove a certificate, and click SSL in the left menu.
4. In the SSL certificates section, locate the certificate you want to remove, and then click its Remove link. Acquia Cloud Platform displays a Remove certificate dialog box
5. Click Remove in the dialog box to permanently remove the certificate from Acquia Cloud Platform.

### Revoking a certificate¶

If you need to delete or deactivate a valid SSL certificate, you must revoke that certificate to prevent an attacker’s website masquerading as your own. Acquia recommends that you deactivate or delete any revoked or expired certificates from all environments. Leaving a revoked certificate active in any environment may result in downtime for your application.

Each SSL certificate vendor has different procedures to perform a certificate revocation. Ensure you follow the instructions your SSL certificate vendor provides. Here are the procedures for two common vendors:

### Renewing or replacing an SSL certificate¶

If you need to replace an SSL certificate that is expiring, you do not need to delete or remove your existing certificate(s). There are two options you can take to replace your SSL certificate: The first is to install an updated certificate that includes new information, such as additional domains/organizational changes, etc. This option includes the same steps as if you were installing a brand new certificate. If this applies to you, follow the instructions on installing a certificate here.

The other option is to install a renewed version of your existing certificate that just has a new expiration date. If there is no change to the details of the certificate itself besides the expiry date, you may not need to generate a new CSR. To install the updated version of the same certificate, follow these steps:

To upload a new SSL certificate to an Acquia Cloud Platform subscription that already has an active SSL certificate, complete the following steps:

1. Sign in to the Cloud Platform user interface as a user with the required permissions.

2. Select your organization, application, and environment.

3. In the left menu, click SSL.

4. Generate a new certificate signing request if there are any changes in your new SSL certificate, such as adding or removing domains.

5. If the CSR that was used to originally obtain your certificate is available and you generated your CSR using the Acquia Cloud Platform user interface:

• On the SSL page, in the Certificate signing requests section, click Install to navigate to the installation form and have the private key prepopulated in its respective field.

If you have questions on this step, see Generate private key in CSR for the CSR you used to obtain the SSL certificate you want to install.

6. If you don’t see the CSR that was used to originally obtain your certificate:

• In the Certificate signing requests section, click View next to the preexisting certificate in the SSL certificates section to find the corresponding private key, as shown in the following screens:

7. Copy the private key to a local text editor before navigating to the installation form by clicking the Install SSL certificate button on your SSL page.

Note

Acquia Cloud Platform stores both the certificate signing request file (ssl.csr) and the private key (ssl.key) in the Cloud API.