Requesting Free SSL/TLS Certificates on Alibaba Cloud

Alibaba Cloud offers free certificate options. This historical guide describes a quota of 20 single-domain DV certificates per user per year with one-year validity; confirm the current quota and validity in the console before applying. The following sections cover issuance, domain validation, download, and installation.

1. Alibaba Cloud free certificates

1. Certificate features

Free allowance described in the original guide:

• Up to 20 certificates per user per calendar year; check the current allowance
• Domain-validated (DV) certificates
• Single-domain certificates only
• One-year validity in the original offering; check current validity

Limitations of the offering described here:

• No wildcard certificates
• No multi-domain certificates
• No automatic renewal
• No automatic deployment

Suitable for:

• Personal websites and blogs
• Small business websites
• Websites using Alibaba Cloud services
• Sites needing only single-domain certificates

2. Advantages

• ✅ Free of charge
• ✅ Straightforward application process
• ✅ Chinese-language interface and support
• ✅ Convenient integration with Alibaba Cloud services

2. Before applying

1. Alibaba Cloud account

Make sure you have an Alibaba Cloud account. If necessary:

• Visit the Alibaba Cloud website
• Register and complete the required identity verification

2. Domain preparation

• Make sure you control the domain
• Complete the required domain filing if using mainland China hosting
• Ensure DNS resolves correctly

3. Request a free certificate

1. Open certificate management

1. Sign in to the Alibaba Cloud console
2. Under Products and services, find SSL certificates (Application security)
3. Or visit https://yundun.console.aliyun.com/?p=cas

2. Order a free certificate

1. Select SSL certificates → Free certificates
2. Click Buy now or Create certificate
3. Select the Free DV SSL offering
4. Click Buy now after confirming the price is zero

3. Enter certificate details

Certificate domain:

• Enter the domain to certify
• For example, www.example.com or example.com
• Note that www.example.com and example.com are different hostnames

Domain validation methods:

• Automatic DNS validation (recommended where available)
• Manual DNS validation
• File validation

4. Choose a validation method

Automatic DNS validation (recommended where available):

• Select automatic validation if the domain uses Alibaba Cloud DNS
• The system creates the validation records automatically
• The records are removed after validation

Manual DNS validation:

• Add the records manually if DNS is hosted elsewhere
• The system displays the required TXT record
• Add the TXT record with your DNS provider

File validation:

• Create a validation file on the web server
• The system displays the required path and contents
• Place the file on the server

5. Complete domain validation

Automatic DNS validation:

1. Select automatic DNS validation
2. The system adds the DNS records
3. Wait for validation, usually a few minutes

Manual DNS validation:

1. Select manual DNS validation
2. View the required TXT record
3. Add it with your DNS provider
4. Wait for DNS propagation, from a few minutes to several hours
5. Click Verify

File validation:

1. Select file validation
2. View the required file path and contents
3. Create the file on your server
4. Make sure it is accessible over HTTP
5. Click Verify

6. Wait for issuance

After validation succeeds, certificate issuance begins:

• This may take a few minutes to several hours
• Check the status in the certificate list
• A notification is sent when issuance succeeds

4. Download and install

1. Download the certificate

After issuance:

1. Open SSL certificates → Free certificates
2. Locate the issued certificate
3. Click Download
4. Select the server type, such as NGINX, Apache, or IIS
5. Download the certificate files

2. Certificate files

The download typically contains:

• Certificate file (.pem or .crt): the server certificate
• Private key file (.key): the private key
• Chain file (.chain.crt): intermediate CA certificates

3. Install on the server

NGINX configuration:

server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/private.key;
    ssl_trusted_certificate /path/to/chain.crt;
    
    # Add the remaining site configuration here.
}

Apache configuration:

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.crt
</VirtualHost>

5. Deploy to Alibaba Cloud services

1. CDN

If you use Alibaba Cloud CDN:

1. Open the CDN console
2. Select the target domain
3. Open HTTPS configuration
4. Upload the certificate and private key
5. Enable HTTPS

2. SLB

If you use Alibaba Cloud Server Load Balancer:

1. Open the SLB console
2. Select the target listener
3. Configure an HTTPS listener
4. Upload the certificate and private key
5. Enable HTTPS

3. OSS

If you use Alibaba Cloud Object Storage Service:

1. Open the OSS console
2. Select the target bucket
3. Open Transfer management → HTTPS certificate
4. Upload the certificate and private key
5. Bind a custom domain

6. Certificate renewal

1. Expiration reminders

Alibaba Cloud sends reminders before expiration through:

• Email
• SMS, if enabled
• Console notifications

2. Renew the certificate

Before expiration, request a replacement:

1. Repeat the issuance procedure above
2. Download the new certificate
3. Install it on the server
4. Upload it again to any Alibaba Cloud services using it

3. Considerations

• The workflow described here does not renew automatically
• Request and deploy replacements manually
• Plan renewal 1–2 weeks before expiration
• Complete deployment before the old certificate expires

7. Common issues

1. Issuance fails

Possible causes:

• Domain validation failed
• DNS changes have not propagated
• Validation timed out

Resolution:

• Verify the DNS records
• Wait for propagation
• Retry validation

2. Download fails

Possible causes:

• Issuance has not completed successfully
• Network problems

Resolution:

• Inspect the certificate
• Retry the download
• Check network connectivity

3. Free quota exhausted

Resolution:

• Wait for the applicable quota reset
• Purchase a certificate
• Use another free certificate service, such as Let's Encrypt through CertOne

8. Comparison with CertOne

1. Feature comparison

Feature	Alibaba Cloud free offering described here	CertOne
Free quota	20 per year in the original offering	No platform issuance quota; CA limits apply
Domain coverage	Single domain	Single domain, multi-domain, wildcard
Certificate validity	Originally 1 year; check current terms	90 days in this guide
Automatic renewal	❌	✅
Automatic deployment	❌	✅
Certificate monitoring	❌	✅
Wildcard certificates	❌	✅ Free issuance

2. Use cases

Alibaba Cloud free certificates suit users who:

• Websites using Alibaba Cloud services
• Need only single-domain certificates
• Can manage certificates manually

CertOne suits users who:

• Need multi-domain or wildcard certificates
• Need automated management
• Need automated deployment and monitoring
• Need free issuance without a platform quota, subject to CA rate limits

Best practices

1. Certificate management

• Record certificate expiration dates
• Set reminders and renew early
• Store private keys securely
• Check certificate status regularly

2. Security recommendations

• Protect private keys with strong passwords where supported
• Set appropriate file permissions
• Back up certificates and private keys regularly
• Never upload private keys to public locations

3. Performance optimization

• Use HTTP/2
• Enable OCSP stapling
• Configure appropriate TLS versions
• Use strong cipher suites

Conclusion

Alibaba Cloud free certificates can be convenient for users of its services, with an integrated application process and Chinese-language support. The original 20-per-year offering described here is historical; check current terms before relying on it.

CertOne supports multi-domain and wildcard issuance, automatic renewal, deployment, and monitoring. It does not impose a platform issuance quota, although CA limits and service credit charges still apply.

Automate your certificates with CertOne ↗

Issue free SSL/TLS certificates and automate renewal, deployment, and monitoring with CertOne. Connect your cloud services, servers, and containers from one dashboard.