--- name: cis-origin title: Managing origin certificates description: Origin certificates are TLS certificates that are issued by IBM Cloud® Internet Services to secure traffic between the CIS edge and your origin server. Order free TLS certificates to install on your origin server. last-updated: 2026-08-06 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/cis?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Managing origin certificates {: #cis-origin-certificates} Origin certificates are TLS certificates that are issued by IBM Cloud® Internet Services to secure traffic between the CIS edge and your origin server. Order free TLS certificates to install on your origin server. {: shortdesc} ![Diagram of an origin certificate](images/origin-cert.svg "Diagram of an origin certificate"){: caption="A diagram of an origin certificate" caption-side="bottom"} CIS origin certificates are valid for use only in CIS. {: note} ## Ordering an origin certificate {: #cis-origin-certificates-ordering} To order an origin certificate, provide a Certificate Signing Request (CSR) or select a private key type for CIS to generate a key and CSR. Specify up to 100 hostnames (including wildcards) on your origin that the certificate protects. Wildcards provide only one level of coverage. Use multiple wildcards on the same certificate for broader coverage (for example, `*.yourdomain.com` and `*.yoursubdomain.yourdomain.com`). CIS Origin Certificates do not permit IP addresses. Specify the expiration. The default certificate expiration is 15 years; the shortest expiration is seven days. The private key is available only after you order a certificate if the private key and CSR were generated by CIS. {: important} To get an origin certificate with the API, see [Get an existing origin certificate](https://cloud.ibm.com/docs/apis/cis#list-origin-certificates). {: tip} ## Installing an origin certificate on your server {: #cis-origin-certificates-installing} ### Apache HTTPD {: #cis-origin-cert-install-apache-httpd} 1. Order an origin certificate. 1. Copy the private key and origin certificate in PEM format into separate files to the directory on your server where you keep your key and certificate files. 1. Locate your Apache configuration file. Typically, the file names are `httpd.conf` or `apache2.conf` and the locations are `/etc/httpd/` or `/etc/apache2/`. However, your configuration file might vary, especially if you use a special interface to manage your server. See Apache's [DistrosDefaultLayout](https://cwiki.apache.org/confluence/plugins/servlet/mobile){: external} for a complete list of default installation layouts. The following command is one way to search for the SSL configuration file on Linux. ```sh grep -i -r "SSLCertificateFile" /etc/httpd/ ``` {: pre} 1. Locate the `` block to configure. Optionally, copy the existing non-secure virtual host for your site to be available through HTTP and HTTPS because each type of connection requires a virtual host. 1. Configure the `` block for SSL. The following example represents a simple configuration for SSL. Use the filenames for your certificate and private key. `SSLCertificateFile` is your origin CA certificate filename and `SSLCertificateKeyFile` is your origin CA private key filename. ```sh DocumentRoot /var/www/html2 ServerName www.mydomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key ``` {: codeblock} 1. Test your configuration. Before you restart Apache, verify that your configuration files have no errors. Run the following command to test your configuration. ```sh apachectl configtest ``` {: pre} 1. Restart Apache. Run the following commands to restart Apache with SSL support. ```sh apachectl stop apachectl start ``` {: pre} If SSL support does not load with `apache start`, run the command `apachectl startssl`. If Apache starts with only SSL support by using `apachectl startssl`, adjust the Apache startup configuration to include SSL support in the command `apachectl start`. Otherwise, if a server restarts, you might be required to manually restart Apache with `apachectl startssl`. This restart typically involves removing the `` and `` tags that enclose your configuration. {: note} ### NGINX {: #cis-origin-cert-install-nginx} 1. Order an origin certificate. 1. Copy the private key and origin certificate in PEM format into separate files to the directory on your server where you keep the key and certificate files. 1. Update your NGINX virtual hosts file. Edit the NGINX virtual host file for your website. The following example represents a server block for SSL support. Enable the `ssl` parameter on listening sockets in the server block for your site to be available through HTTP and HTTPS. ```sh server { listen 80; listen 443; ssl on; ssl_certificate /path/to/your_certificate.pem; ssl_certificate_key /path/to/your_private.key; location / { root /home/www/public_html/yourdomain.com/public/; index index.html; } } ``` {: codeblock} 1. Restart NGINX. Run one of the following commands to restart NGINX. ```sh sudo /etc/init.d/nginx restart sudo systemctl restart nginx ``` {: pre} ### Apache Tomcat {: #cis-origin-cert-install-apache-tomcat} 1. Order an origin certificate. 1. Copy the private key and origin certificate in PKCS #7 format (`cert.p7b`) to separate files in the directory on your server where you keep the key and certificate files. You must install the SSL Certificate file to the same keystore and under the same alias name (or "server") that you used to generate your CSR. The installation in the next step does not work if the SSL Certificate file is installed to a different keystore. {: note} 1. Install the certificate. Run the following command to install the SSL Certificate file to your keystore. ```sh keytool -import -trustcacerts -alias server -file cert.p7b -keystore your_site_name.jks ``` {: pre} A confirmation message appears: **"Certificate reply was installed in the keystore."** Enter **y** or **yes** if asked to trust the certificate. Your keystore file (your_site_name.jks) is now ready to use on your Tomcat Server. 1. Configure your SSL connector. Configure an SSL connector for Tomcat to be able to accept secure connections. 1. Open the Tomcat server.xml file in a text editor. The server.xml file is typically located in the conf folder of your Tomcat's home directory. 1. Identify the connector to use to secure the new keystore. A connector with port 443 or 8443 is typically used. 1. Remove any comment tags that might be surrounding the connector. 1. Update the correct keystore filename and password in your connector configuration. The following example represents a configured SSL Connector block. ```sh ``` {: codeblock} If your Tomcat version is earlier than Tomcat 7, change `keystorePass` to `keypass`. {: note} 1. Save your server.xml file. 1. Restart Tomcat. ### Microsoft Internet Information Services (IIS) 7.0 {: #cis-origin-cert-install-ms-iis7} 1. Create a CSR in IIS Manager and export it as `.pem`. The IIS Manager is located under Administrative Tools. 1. Order a CIS origin certificate by using your CSR. 1. Copy the origin certificate to the desktop of your server. 1. Open IIS Manager and select your server's hostname under **Connections**. 1. Select **Server Certificates** from the IIS section in the center menu. 1. Select the action **Complete Certificate Request** from the Actions menu. On the **Specify Certificate Authority Response** page under **File name containing the certification authority's response**, click `...` to browse to the `.cer` certificate file that was copied to the desktop, select the file, and click **Open**. 1. Enter a friendly name for the certificate. The friendly name identifies the certificate. 1. Select **OK** to finish the certificate installation to your server. 1. Bind the certificate to your website. Select your website by expanding **Sites** under your server's name in the menu under **Connections** in the IIS Manager. Select **Bindings** under **Edit Site** from the Actions menu. Select **Add** from the Site Bindings window and submit the following information. ```sh Type https IP Address All Unassigned Port 443 SSL Certificate your_cert_friendly_name ``` {: codeblock} 1. Your website is now configured to accept secure connections. ### Microsoft Internet Information Services (IIS) 8.0 and 8.5 {: #cis-origin-cert-install-ms-iis8-8.5} 1. Create a CSR in IIS Manager and export it as `.pem`. The IIS Manager is located under Administrative Tools. 1. Order a CIS origin certificate by using your CSR. 1. Copy the origin certificate to the desktop of your server. 1. Open IIS Manager and select your server's hostname under **Connections**. 1. Select **Server Certificates** from the IIS section in the center menu. 1. Select the action **Complete Certificate Request** from the Actions menu. On the **Specify Certificate Authority Response** page under **File name containing the certification authority's response**, click `...` to browse to the `.cer` certificate file that was copied to the desktop, select the file, and click **Open**. 1. Enter a friendly name for the certificate, which identifies the certificate. 1. Select **OK** to finish the certificate installation to your server. 1. Bind the certificate to your website. Select your website by expanding **Sites** under your server's name in the menu under **Connections** in the IIS Manager. Select **Bindings** under **Edit Site** from the Actions menu. Select **Add** from the Site Bindings window and submit the following information. ```sh Type https IP Address All Unassigned Port 443 SSL Certificate your_cert_friendly_name ``` {: codeblock} 1. Optionally, configure your SSL certificate to use Server Name Indication (SNI) if you have multiple sites that use SSL bound to the same IP address. Select the **Require Server Name Indication** box. 1. Your website is now configured to accept secure connections. ### Certificate chains {: #certificate-chains} In some cases, the origin web servers require you to upload the certificate chain. Use these links to download either an [ECC](https://developers.cloudflare.com/ssl/static/origin_ca_ecc_root.pem){: external} or an [RSA](https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem){: external} version, and then upload the certificate chain to your origin web server. ## Revoking an origin certificate {: #cis-origin-certificates-revoke} Delete your CIS origin certificate. This process can't be undone. To revoke an origin certificate with the API, see [Revoke a created origin certificate](https://cloud.ibm.com/docs/apis/cis#revoke-origin-certificate).