Cloud Platform CDN¶

Prerequisites¶

1. Ensure that the Platform CDN entitlement has been added to your Acquia subscription.
2. Have at least one custom domain, preferably with a valid SSL/TLS root certificate.
3. Get an understanding of your site’s caching strategy.

openssl x509 -in [path-to-your/certificate.crt] -text -noout | grep 'Public-Key'

Incompatible features¶

• First Click Free
• Passing Acquia-provided cookies
• Redirects based on the request user-agent header
• GeoIP
• HTTP Basic Authentication

HIPAA and PCI sensitive objects¶

HIPAA and PCI compliance is always on by default for all cached objects with Platform CDN. It is up to your team to configure objects that do not require this compliance.

If your objects are not HIPAA or PCI compliant and you want the cache lifetime longer than 24 hours, you must add the header X-Acquia-CDN-HP-Off. This indicates that the object is not compliant and can be stored in cache or on disk at the CDN. HIPAA and PCI sensitive objects are not stored on disk at the CDN by default.

For more information on HIPAA and PCI compliance on Cloud Platform, see Compliance with standards and regulations.

Disabling Platform CDN for a single or select group of domains¶

To disable Platform CDN for a single or select group of custom domains, visit your DNS provider and point DNS for the chosen domain(s) to your Acquia load balancer EIP. This information is available in the Regional Origin sub-section of DNS information.

Purge requests¶

Purge immediately removes content from Varnish. When the client requests the data again, the request bypasses Varnish and Drupal responds to the request. This is a path-based approach. This is the primary approach for customers using Drupal 7 and the Acquia Purge module.

Ban requests¶

Ban adds cached object references to a list, and client requests are checked against this list to see if there are any matches. If so, new content is fetched from the application, returned to the client, and added to the cache. Cached content is updated after a client requests the information, unlike the Purge method. This is the primary approach for customers using Drupal 9 with Purge and Acquia Purge modules.

Platform CDN cache invalidation¶

Platform CDN respects HTTP headers Cache-Control and Surrogate-Control and tag-based invalidation. Acquia recommends using both methods as part of your application’s caching strategy.

Manually purging caches using Drupal admin¶

Manually purging caches using the Cloud Platform user interface¶

1. Log in to Cloud Platform user interface.

2. Navigate to your environment, click Domains Management menu (on the left navigation bar), and on the Domains tab, select Clear all caches for the domain for which you want to clear the cache.

   This clears both Acquia Varnish and Platform CDN caches.

   

Manually purging all caches or individual objects from Platform CDN¶

1. Retrieve the value of service_id and token from Acquia Support.

2. Purge the Platform CDN by running the following curl command with the token in the header and the service_id in the URL path as shown in the following example:

   curl -X POST -H "Fastly-Key:<Platform CDN token>" -H "Accept: application/json" https://api.fastly.com/service/<Platform CDN Service ID>/purge_all
   

   Use the token and Service ID values provided to you by Acquia Support.

   For example,

   curl -X POST -H "Fastly-Key:DMDf1ryoZiERdryIxQAb4seLOBqLfLMU" -H "Accept: application/json" https://api.fastly.com/service/4SsvFsxK25Z7t16kTqzu7d/purge_all
   

   Before manually purging the Platform CDN cache, purge your Varnish cache to ensure cache consistency. For more information, see Varnish: Bypassing the cache.

Provisioning¶

If you experience issues provisioning Cloud Platform CDN, review the following likely causes:

• There are no custom domains registered to your environment:

  The default *.acquia-sites.com domain can’t be added to CDN. You must add at least one of your own domains before Platform CDN can be provisioned.

• Your SSL/TLS certificate is not 2048-bit:

  Ensure your certificates use a 2048-bit private key before enabling the Platform CDN. You can only use the certificates that are created with a 2048-bit private key. A 1024-bit key is outdated, and a 4096-bit SSL key is supported, but requires a manual upload and may not work with all browsers. If you have a specific security or compliance requirement, contact Acquia support for assistance uploading a 4096-bit certificate.

• There is an older SSL/TLS certificate being served instead of a newly uploaded certificate:

  Platform CDN will serve a valid certificate with the closest matching CN or SAN. Deactivate any older certificates through the Cloud Platform user interface to remove them from Platform CDN.

• Your domain was previously registered with Acquia’s CDN partner, Fastly Inc.:

  If you have previously created a Fastly account using one of your domain names, contact Acquia support. Acquia support will work with Fastly to transfer the domain for use on Platform CDN.

Performance¶

• HTTP to HTTPS redirect gets stuck in a 301 redirect loop:

  Purge all caches. If the problem persists, contact Acquia support.

• SSO redirects browser to not-logged-in content:

  Ensure your application is serving a Cache-Control header with value max-age:3 or must-revalidate. This ensures that the browser doesn’t use its local cache.

• Purge token lost or doesn’t work:

  Use Drush 9 to run drush p:dia. If that command is not available, use the following method to ensure that all modules are installed and enabled:

  # in your local dev environment
  git clone [email protected]:manualtest.git
  cd manualtest/docroot
  
  # Use composer to install acquia_purge 1.1 beta and its dependencies
  composer config minimum-stability 'beta'
  composer config prefer-stable true
  composer require 'drupal/acquia_purge:1.1-beta1'
  
  # Push the code back and enable the module using drush
  git add.
  git commit -a -m "Add Acquia Purge module"
  git push
  ssh {{YOUR SSH URI HERE}}
  sudo su
  cd /var/www/html/{{YOUR ENVIRONMENT NAME HERE}}/docroot/
  source /mnt/users/[SITEGROUP NAME]/dev.shell
  drush9 en acquia_purge
  yes
  #>>  [success] Successfully enabled: acquia_purge, purge, purge_drush
  
  # list all the available purgers
  drush9 p:purger-lsa
  #>> --------------------- ---------------------------- ----------------------------------------------
  #>> Plugin                Label                        Description
  #>> --------------------- ---------------------------- ----------------------------------------------
  #>> acquia_purge          Acquia Cloud                 Invalidate content from Acquia Cloud.
  #>> acquia_platform_cdn   Acquia Platform CDN (beta)   Invalidate content from Acquia Platform CDN.
  #>> --------------------- ---------------------------- ----------------------------------------------
  
  # Enable the acquia purge and then the acquia_platform_cdn in that order to ensure
  # varnish clears first and then platform_cdn clears after a short delay
  drush9 p:purger-add acquia_purge
  drush9 p:purger-add acquia_platform_cdn
  
  # Enable the other purge modules that need manually enabled for some reason
  drush9 pm:list | grep purge
  drush9 en purge_processor_cron
  drush9 en purge_processor_lateruntime
  drush9 en purge_queuer_coretags
  drush9 en purge_tokens
  drush9 en purge_ui
  drush9 en purge_drush
  drush9 pm:list | grep purge
  
  # Run the diagnostic
  drush9 p:dia