A Must-Read Guide For Beginners: How To Install And Automatically Update HTTPS Certificates On Alibaba Cloud Servers In Hong Kong

Introduction: This article is aimed at website owners and developers using Alibaba Cloud servers (Hong Kong), providing a systematic guide on how to apply for, install, and configure automatic renewal of HTTPS certificates on ECS. It covers practical steps as well as common issues, helping beginners quickly establish secure connections.

Preparatory work: Domain Name Resolution and Security Group Settings

First, confirm that the domain name has been resolved to the Hong Kong ECS public IP address (A record), and open ports 80/443 in the CVM security group and operating system firewall on the Alibaba Cloud console. Only when the port and DNS are correct can the certificate application and verification proceed smoothly.

Get certificate: Use Let’s Encrypt with Certbot (recommended)

After installing Certbot on ECS, you can quickly apply for a free certificate using the HTTP-01 challenge. The commonly used commands are certbot certonly --webroot or certbot --nginx ； During this period, it is necessary to ensure that the website’s root directory is accessible from the public internet to complete the verification.

Alternative tools: acme.sh Obtaining and lightweight deployment

acme.sh It is a lightweight script that supports various DNS APIs and web-based methods. For scenarios that require DNS-01 validation (such as wildcard domain certificates or situations where port 80 cannot be opened), the DNS interface can be configured to automatically issue certificates and write them to a specified directory, facilitating automated deployment.

Explanation of Alibaba Cloud Certificate Service (Managed)

If you wish to host certificates using the Alibaba Cloud console or purchase commercial certificates, you can apply for and download the certificate files in Certificate Services, or use the automatic deployment feature of cloud services to bind them to load balancing/CDN. The hosting method is suitable for enterprise-level use and one-click binding scenarios.

Deploy certificates to Nginx / Apache

Place the certificate files (certificate, private key, intermediate chain) in the server’s secure directory, and modify the Nginx or Apache configuration settings to point to the corresponding paths. After reloading the service, check the configuration syntax and ensure the certificate chain is complete to avoid browser warnings of distrust.

Auto-renewal: Built-in features of cron, systemd, and certificate tools

The validity period of Let’s Encrypt certificates is 90 days. It is recommended to use certbot renew or acme.sh The --cron mechanism works in conjunction with cron or systemd timers to execute tasks regularly, and it automatically reloads the web service after renewal to make the new certificate effective.

Common Network and Security Group Troubleshooting (Special Notes for Hong Kong ECS)

The Hong Kong node may have ports restricted by the ISP or require an IP allowlist due to network policies. When verification fails, check whether DNS resolution is working, whether ports 80/443 are blocked by the ISP or intermediate firewalls, and whether the security group rules match those of the operating system firewall.

Testing and Verification: Browsers and Online Tools

After the certificate is installed, verify the certificate chain, protocol support, and vulnerabilities by accessing it through a browser, using curl -I https://yourdomain, and with third-party SSL testing tools. Ensure there are no mixing issues, and check the OCSP/CRL responses and expiration times.

Summary and Recommendations: When deploying HTTPS on Alibaba Cloud ECS in Hong Kong, it is recommended to prepare domain name resolution and port rules in advance. Choose Let’s Encrypt or acme.sh Achieve free automated certificate issuance, and configure regular renewal and service overload handling. For traffic and performance optimization, managed certificates can be used in conjunction with CDN and load balancing to ensure site stability and compliance with security standards.