Cloud Platform CDN¶

Prerequisites¶

1. Ensure that the Platform CDN entitlement is added to your Acquia subscription.
2. Have at least one custom domain, preferably with a valid SSL/TLS root certificate.
3. Get an understanding of your site’s caching strategy.

openssl x509 -in [path-to-your/certificate.crt] -text -noout | grep 'Public-Key'

Incompatible features¶

• First Click Free
• Passing Acquia-provided cookies
• Redirects based on the request user-agent header
• GeoIP
• HTTP Basic Authentication

HIPAA and PCI sensitive objects¶

By default, HIPAA and PCI compliance are always on for all cached objects with Platform CDN. It is up to your team to configure objects that do not require this compliance.

If your objects are not HIPAA or PCI compliant and you want the cache lifetime longer than 24 hours, you must add the header X-Acquia-CDN-HP-Off. This indicates that the object is not compliant and can be stored in cache or on disk at the CDN. HIPAA and PCI sensitive objects are not stored on disk at the CDN by default.

For more information on HIPAA and PCI compliance on Cloud Platform, see Compliance with standards and regulations.

Disabling Platform CDN for a single or select group of domains¶

To disable Platform CDN for a single or select group of custom domains, visit your DNS provider and point DNS for the chosen domain(s) to your Acquia load balancer EIP. This information is available in the Regional Origin sub-section of DNS information.

Purge requests¶

Purge immediately removes content from Varnish. When the client requests the data again, the request bypasses Varnish and Drupal responds to the request. This is a path-based approach. This is the primary approach for customers using Drupal 7 and the Acquia Purge module.

Ban requests¶

Ban adds cached object references to a list, and client requests are checked against this list to see if there are any matches. If so, new content is fetched from the application, returned to the client, and added to the cache. Cached content is updated after a client requests the information, unlike the Purge method. This is the primary approach for customers using Drupal 9 with Purge and Acquia Purge modules.

Platform CDN cache invalidation¶

Platform CDN respects Cache-Control and Surrogate-Control HTTP headers and tag-based invalidation. Acquia recommends using both methods as part of your application’s caching strategy.

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -I http://nodejs-i.john-galvin.com/
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 1840
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 10:19:05 GMT
Age: 1228
X-Served-By: cache-bom4733-BOM
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1664360345.110256,VS0,VE1
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -I http://nodejs-i.john-galvin.com/
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 1840
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 10:19:38 GMT
Age: 1262
X-Served-By: cache-bom4734-BOM
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1664360379.803699,VS0,VE1
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -I http://nodejs-i.john-galvin.com/
HTTP/1.1 200 OK
Content-Length: 1840
Server: nginx
Content-Type: text/html
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 10:25:53 GMT
Age: 1636
X-Served-By: cache-bom4723-BOM
X-Cache: HIT
X-Cache-Hits: 2
X-Timer: S1664360753.388986,VS0,VE0
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -I http://nodejs-i.john-galvin.com/
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 1840
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 10:27:15 GMT
Age: 1718
X-Served-By: cache-bom4740-BOM
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1664360835.145788,VS0,VE1
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -I http://nodejs-i.john-galvin.com/
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 1840
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 10:39:35 GMT
Age: 2458
X-Served-By: cache-bom4744-BOM
X-Cache: HIT
X-Cache-Hits: 1
X-Timer: S1664361575.491825,VS0,VE1
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ curl -Ik https://testdev.prod.acquia-sites.com/
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 28 Sep 2022 11:12:52 GMT
Content-Type: text/html
Connection: keep-alive
Cache-Control: max-age=100, no-cache

[cloudservicesdev|hosting-dev:nodejs-dev] ~/abc/git$ date && curl -I http://nodejs-i.john-galvin.com/
Wed Sep 28 16:32:12 IST 2022
HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Cache-Control: max-age=100, no-cache
Content-Length: 1840
Accept-Ranges: bytes
Date: Wed, 28 Sep 2022 11:02:13 GMT
Age: 0
X-Served-By: cache-maa10229-MAA
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1664362933.464853,VS0,VE445
Via: Acquia Platform CDN 1.176, HTTP/1.1 forward.http.proxy:3128
Connection: keep-alive

Manually purging caches using Drupal admin¶

Manually purging all caches or individual objects from Platform CDN¶

1. Retrieve the value of service_id and token from Acquia Support.

2. Purge Platform CDN by running the following curl command with the token in the header and the service_id in the URL path as shown in the following example:

   curl -X POST -H "Fastly-Key:<Platform CDN token>" -H "Accept: application/json" https://api.fastly.com/service/<Platform CDN Service ID>/purge_all
   

   Use the token and Service ID values provided to you by Acquia Support.

   For example,

   curl -X POST -H "Fastly-Key:DMDf1ryoZiERdryIxQAb4seLOBqLfLMU" -H "Accept: application/json" https://api.fastly.com/service/4SsvFsxK25Z7t16kTqzu7d/purge_all
   

   Before manually purging the Platform CDN cache, purge your Varnish cache to ensure cache consistency. For more information, see Varnish: Bypassing the cache.

Manually purging caches using the Cloud Platform user interface¶

1. Sign in to the Cloud Platform user interface.

2. Navigate to your environment and click the Domains Management menu.

3. On the Domains tab, select Clear all caches for the domain for which you want to clear the cache.

   The system clears both Acquia Varnish and Platform CDN caches.

   

Provisioning¶

If you experience issues provisioning Cloud Platform CDN, review the following likely causes:

• There are no custom domains registered to your environment:

  The default *.acquia-sites.com domain cannot be added to CDN. You must add at least one of your own domains before Platform CDN can be provisioned.

• Your SSL/TLS certificate is not 2048-bit:

  Ensure your certificates use a 2048-bit private key before enabling Platform CDN. You can only use the certificates that are created with a 2048-bit private key. A 1024-bit key is outdated, and a 4096-bit SSL key is supported, but requires a manual upload and might not work with all browsers. If you have a specific security or compliance requirement, contact Acquia support for assistance uploading a 4096-bit certificate.

• There is an older SSL/TLS certificate being served instead of a newly uploaded certificate:

  Platform CDN serves a valid certificate with the closest matching CN or SAN. Deactivate any older certificates through the Cloud Platform user interface to remove them from Platform CDN.

• Your domain was previously registered with Acquia’s CDN partner, Fastly Inc.:

  If you have previously created a Fastly account using one of your domain names, contact Acquia support. Acquia support will work with Fastly to transfer the domain for use on Platform CDN.

Performance¶

• HTTP to HTTPS redirect gets stuck in a 301 redirect loop:

  Purge all caches. If the problem persists, contact Acquia support.

• SSO redirects browser to not-logged-in content:

  Ensure that your application is serving a Cache-Control header with max-age:3 or must-revalidate value. This ensures that the browser does not use its local cache.

• Purge token lost or doesn’t work:

  Use Drush 9 to run drush p:dia. If that command is not available, use the following method to ensure that all modules are installed and enabled:

  # in your local dev environment
  git clone [email protected]:manualtest.git
  cd manualtest/docroot
  
  # Use composer to install acquia_purge 1.1 beta and its dependencies
  composer config minimum-stability 'beta'
  composer config prefer-stable true
  composer require 'drupal/acquia_purge:1.1-beta1'
  
  # Push the code back and enable the module using drush
  git add.
  git commit -a -m "Add Acquia Purge module"
  git push
  ssh {{YOUR SSH URI HERE}}
  sudo su
  cd /var/www/html/{{YOUR ENVIRONMENT NAME HERE}}/docroot/
  source /mnt/users/[SITEGROUP NAME]/dev.shell
  drush9 en acquia_purge
  yes
  #>>  [success] Successfully enabled: acquia_purge, purge, purge_drush
  
  # list all the available purgers
  drush9 p:purger-lsa
  #>> --------------------- ---------------------------- ----------------------------------------------
  #>> Plugin                Label                        Description
  #>> --------------------- ---------------------------- ----------------------------------------------
  #>> acquia_purge          Acquia Cloud                 Invalidate content from Acquia Cloud.
  #>> acquia_platform_cdn   Acquia Platform CDN (beta)   Invalidate content from Acquia Platform CDN.
  #>> --------------------- ---------------------------- ----------------------------------------------
  
  # Enable the acquia purge and then the acquia_platform_cdn in that order to ensure
  # varnish clears first and then platform_cdn clears after a short delay
  drush9 p:purger-add acquia_purge
  drush9 p:purger-add acquia_platform_cdn
  
  # Enable the other purge modules that need manually enabled for some reason
  drush9 pm:list | grep purge
  drush9 en purge_processor_cron
  drush9 en purge_processor_lateruntime
  drush9 en purge_queuer_coretags
  drush9 en purge_tokens
  drush9 en purge_ui
  drush9 en purge_drush
  drush9 pm:list | grep purge
  
  # Run the diagnostic
  drush9 p:dia