Configuring HTTPS

Written by

Updated at November 26, 2024

Select a certificate from Certificate Manager
Upload your own security certificate

If you are using a bucket to host a static website, then to access the website via HTTPS, you will need to upload your own security certificate and a corresponding secret key.

Object Storage only supports PEM-encoded certificates.

Note

Access to the bucket over HTTPS is granted within thirty minutes of uploading the certificate.

Request redirects from HTTP to HTTPS are enabled automatically once you set up HTTPS access to a bucket. No other settings are required.

Select a certificate from Certificate Manager

Management console

Yandex Cloud CLI

Terraform

API

In the management console, select Object Storage from the list of services and go to the bucket you need.
In the left-hand panel, select Security.
Select the HTTPS tab.
Click Configure.
In the Source field, select Certificate Manager.
In the Certificate field, select the certificate from the list that opens.

Note

If you do not have a certificate in Yandex Certificate Manager, click Go to Certificate Manager and follow the guide on how to create your first certificate.
Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

See the description of the CLI command to edit a bucket ACL:
```
yc storage bucket update --help
```

Run the following command:

yc storage bucket set-https --name <bucket_name> --certificate-id <certificate_ID>

Where:

--name: Name of the bucket to configure HTTPS for.
--certificate-id: Certificate ID in Certificate Manager.

Result:

source_type: SOURCE_TYPE_MANAGED_BY_CERTIFICATE_MANAGER
certificate_id: fpqe2g0hfr0e********

Note

Terraform uses a service account to interact with Object Storage. Assign to the service account the required role, e.g., storage.admin, for the folder where you are going to create resources.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the documentation on the Terraform website or mirror website.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To select a certificate from Certificate Manager:

Open the Terraform configuration file and add the https section to the bucket description:
```
...
resource "yandex_storage_bucket" "b" {
  bucket = "my-policy-bucket"

  https {
    certificate_id = "<certificate_ID>"
  }
}
...
```
Where:
- certificate_id: Сertificate ID in Certificate Manager that will be used for the bucket.
For more information about the yandex_storage_bucket resource parameters in Terraform, see the provider documentation.
Check the configuration using this command:
```
terraform validate
```
If the configuration is correct, you will get this message:
```
Success! The configuration is valid.
```
Run this command:
```
terraform plan
```
The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.
Apply the configuration changes:
```
terraform apply
```
Confirm the changes: type yes into the terminal and press Enter.

You can use the management console to check the selected certificate.

To select a certificate from Certificate Manager, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.

Upload your own security certificate

To upload a custom certificate, use Certificate Manager.

When you are uploading a chain of certificates, it should start with the domain certificate and end with the root certificate. You can create a chain file using the following command:

cat domain.pem intermediate.pem rootca.pem > bundle.pem

Where domain.pem is the domain certificate, intermediate.pem is the intermediate certificate, rootca.pem is the root certificate, and bundle.pem is the resulting chain.

To upload a certificate:

Management console

API

In the management console, select Object Storage from the list of services and go to the bucket you need.
In the left-hand panel, select Security.
Select the HTTPS tab.
Click Configure.
In the Source field, select Your certificate.
Add Certificate and Secret key.
Click Save.

To upload your own security certificate, use the setHTTPSConfig REST API method for the Bucket resource or the BucketService/SetHTTPSConfig gRPC API call.

Note

You can get files from a publicly available bucket using a public link via both HTTP and HTTPS even if the bucket has no website hosting configured. In this case, a cloud-level certificate from GlobalSign will be used for HTTPS access.

Configuring HTTPS

Select a certificate from Certificate ManagerSelect a certificate from Certificate Manager

Upload your own security certificateUpload your own security certificate

Was the article helpful?

Select a certificate from Certificate Manager

Upload your own security certificate