Configuring TLS certificates for HTTPS connections between clients and the CDN
To enable clients to request files over HTTPS (e.g., if you use a URI with the https scheme or enabled redirection from HTTP to HTTPS in the CDN resource settings), you need to configure a TLS certificate for the domain name used to distribute content specified in the resource.
Certificates from Yandex Certificate Manager are supported. You can issue a new Let's Encrypt® certificate or upload one of your own.
The certificate must be located in the same folder as your CDN resource.
The certificate is configured when creating a resource. You can change it afterwards together with other basic resource settings. For more information, see these guides:
TLS profiles
Cloud CDN supports TLS 1.0 and higher for client connections.
For added CDN resource security, configure a dedicated profile to restrict the allowed TLS versions.
Supported security profiles:
-
PROFILE_STRICT: Only TLS 1.3-compatible ciphers.Note
All TLS 1.3 ciphers are considered secure.
-
PROFILE_SECURE: Ciphers compatible with TLS 1.2+ that support PFS (Perfect Forward Secrecy) and AEAD (Authenticated Encryption with Asssociated Data). -
PROFILE_COMPATIBLE: Ciphers compatible with TLS 1.2+ that have no known critical vulnerabilities.This profile is used by default.
-
PROFILE_LEGACY: Ciphers compatible with TLS 1.0+ that have no known critical vulnerabilities.
You can customize this setting via the API when creating or updating a CDN resource. For more information, see Configuring a TLS profile for a CDN resource.
Domain ownership verification
If you issued a Let's Encrypt certificate in Certificate Manager and use it in a CDN resource, you need to pass the domain ownership verification procedure. Cloud CDN supports only the DNS type verification with the help of a TXT or CNAME DNS record. The CDN load balancer will return the 404 status code in response to file requests over paths formatted as /.well-known/acme-challenge/<file_name> that are used for HTTP domain rights checks.
If you use a certificate of your own uploaded to Certificate Manager in a CDN resource, no domain rights check is required.