Configuring HTTPS
If you are using a bucket to host a static website, then to access the website via HTTPS, you will need to upload your own security certificate and a corresponding secret key.
Object Storage only supports PEM
Note
Access to the bucket over HTTPS is granted within thirty minutes of uploading the certificate.
Request redirects from HTTP to HTTPS are enabled automatically once you set up HTTPS access to a bucket. No other settings are required.
Select a certificate from Certificate Manager
-
In the management console
, select Object Storage from the list of services and go to the bucket you need. -
In the left-hand panel, select
Security. -
Select the HTTPS tab.
-
Click Configure.
-
In the Source field, select Certificate Manager.
-
In the Certificate field, select the certificate from the list that opens.
Note
If you do not have a certificate in Yandex Certificate Manager, click Go to Certificate Manager and follow the guide on how to create your first certificate.
-
Click Save.
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
-
See the description of the CLI command to edit a bucket ACL:
yc storage bucket update --help
-
Run the following command:
yc storage bucket set-https --name <bucket_name> --certificate-id <certificate_ID>
Where:
--name
: Name of the bucket to configure HTTPS for.--certificate-id
: Certificate ID in Certificate Manager.
Result:
source_type: SOURCE_TYPE_MANAGED_BY_CERTIFICATE_MANAGER certificate_id: fpqe2g0hfr0e********
Note
Terraform uses a service account to interact with Object Storage. Assign to the service account the required role, e.g., storage.admin
, for the folder where you are going to create resources.
Terraform
For more information about the provider resources, see the documentation on the Terraform
If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
If you don't have Terraform, install it and configure the Yandex Cloud provider.
To select a certificate from Certificate Manager:
-
Open the Terraform configuration file and add the
https
section to the bucket description:... resource "yandex_storage_bucket" "b" { bucket = "my-policy-bucket" https { certificate_id = "<certificate_ID>" } } ...
Where:
certificate_id
: Сertificate ID in Certificate Manager that will be used for the bucket.
For more information about the
yandex_storage_bucket
resource parameters in Terraform, see the provider documentation . -
Check the configuration using this command:
terraform validate
If the configuration is correct, you will get this message:
Success! The configuration is valid.
-
Run this command:
terraform plan
The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
into the terminal and press Enter.You can use the management console
to check the selected certificate.
To select a certificate from Certificate Manager, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.
Upload your own security certificate
To upload a custom certificate, use Certificate Manager.
When you are uploading a chain of certificates, it should start with the domain certificate and end with the root certificate. You can create a chain file using the following command:
cat domain.pem intermediate.pem rootca.pem > bundle.pem
Where domain.pem
is the domain certificate, intermediate.pem
is the intermediate certificate, rootca.pem
is the root certificate, and bundle.pem
is the resulting chain.
To upload a certificate:
- In the management console
, select Object Storage from the list of services and go to the bucket you need. - In the left-hand panel, select
Security. - Select the HTTPS tab.
- Click Configure.
- In the Source field, select Your certificate.
- Add Certificate and Secret key.
- Click Save.
To upload your own security certificate, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.
Note
You can get files from a publicly available bucket using a public link via both HTTP and HTTPS even if the bucket has no website hosting configured. In this case, a cloud-level certificate from GlobalSign