Contact UsGet started

Configuring HTTPS

Written by
Updated at February 21, 2025

If you are using your bucket to host a static website, you need to upload your own security certificate and the respective secret key to access the website over HTTPS.

Alert

Starting July 1, 2025, Object Storage will discontinue support for TLS protocol versions 1.0 and 1.1.

For more information, see TLS protocol.

Object Storage only supports PEM-encoded certificates.

Note

The bucket becomes accessible over HTTPS within 30 minutes of uploading the certificate.

Request redirects from HTTP to HTTPS are enabled automatically once you set up HTTPS access to a bucket. No other settings are required.

Selecting a certificate from Certificate Manager

  1. In the management console, select Object Storage from the list of services and go to the bucket in question.

  2. In the left-hand panel, select Security.

  3. Select the HTTPS tab.

  4. Click Configure.

  5. In the Source field, select Certificate Manager.

  6. In the Certificate field, select the certificate from the list that opens.

    Note

    If you do not have a certificate in Yandex Certificate Manager yet, click Go to Certificate Manager and follow this guide to create your first certificate.

  7. Click Save.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder through the --folder-name or --folder-id parameter.

  1. See the description of the CLI command for editing a bucket ACL:

    yc storage bucket update --help

  2. Run this command:

    yc storage bucket set-https --name <bucket_name> --certificate-id <certificate_ID>

    Where:

    • --name: Name of the bucket to configure HTTPS for.
    • --certificate-id: Certificate ID in Certificate Manager.

    Result:

    source_type: SOURCE_TYPE_MANAGED_BY_CERTIFICATE_MANAGER
certificate_id: fpqe2g0hfr0e********

Note

Terraform uses a service account to interact with Object Storage. Assign to the service account the required role, e.g., storage.admin, for the folder where you are going to create resources.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the documentation on the Terraform website or mirror website.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To select a certificate from Certificate Manager:

  1. Open the Terraform configuration file and add the https section to the bucket description:

    ...
resource "yandex_storage_bucket" "b" {
  bucket = "my-policy-bucket"

  https {
    certificate_id = "<certificate_ID>"
  }
}
...

    Where:

    • certificate_id: Certificate ID in Certificate Manager that will be used for the bucket.

    For more information about the yandex_storage_bucket resource parameters in Terraform, see this TF provider article.

  2. Check the configuration using this command:

    terraform validate

    If the configuration is correct, you will get this message:

    Success! The configuration is valid.

  3. Run this command:

    terraform plan

    The terminal will display a list of resources with their parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.

  4. Apply the configuration changes:

    terraform apply

  5. Confirm the changes: type yes into the terminal and press Enter.

    You can check the selected certificate using the management console.

To select a certificate from Certificate Manager, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.

Uploading a custom security certificate

To upload a custom certificate, use Certificate Manager.

When uploading a certificate chain, make sure it starts with the domain certificate and ends with the root one. To create a chain file, use the following command:

cat domain.pem intermediate.pem rootca.pem > bundle.pem

Where domain.pem is the domain certificate, intermediate.pem is the intermediate certificate, rootca.pem is the root certificate, and bundle.pem is the resulting chain.

To upload a certificate:

  1. In the management console, select Object Storage from the list of services and go to the bucket in question.
  2. In the left-hand panel, select Security.
  3. Select the HTTPS tab.
  4. Click Configure.
  5. In the Source field, select Your certificate.
  6. Add Certificate and Secret key.
  7. Click Save.

To upload a custom security certificate, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.

Note

You can get files from a publicly available bucket using a public link via both HTTP and HTTPS even if website hosting is not configured for the bucket. In this case, a cloud-level certificate from GlobalSign will be used for HTTPS access.

Previous
Multiple domain name support
Next
All tutorials