Custom SSL Certificate

SSL certificate support gives a significant level of security for your domain names. With Jelastic PaaS, hosting of applications that need SSL becomes fairly easy.

In addition to the Jelastic SSL, we provide an ability to upload and use custom SSL certificates for your environments. Jelastic supports the following certificate types:
  • Self-signed
  • Wildcard
  • Multiple domain
  • Extended validation single domain
  • Extended validation multiple domain
  • UCC Exchange
  • Low assurance/domain-validated certificate
  • Code signing certificate
  • Email certificate
  • Root signing certificate

In this instruction we’ll show you how to get a single-domain Custom SSL certificate enabled at your environment.

Generate a Custom SSL Certificate

In order to add the Custom SSL certificate to your Jelastic environment, you need to have:

  • custom domain name purchased;
  • server key;
  • intermediate certificate or certificates chain (CA);
  • domain certificate.

Therefore, follow the next instruction:

1. Buy a Domain name using any domain registrar (e.g. mysite.com).

2. Generate your server key for the purchased domain name and create a Certificate Request on its basis with the help of any preferred tool.

We’ll use OpenSSL as an example. Depending on the operating system you are using, perform the following steps:

For Windows

Download the latest OpenSSL tool version. Extract the received archive and run the tool by double-clicking the openssl.exe file in the bin folder. Subsequently the files created with OpenSSL will appear in the same bin directory by default.

  • First, you need to generate an SSH private server key. For that execute the following command:

genrsa -out {filename} {length}

where

{filename} - name of the output key file with .key extension (e.g. server.key)

{length} - private key length in bits (e.g. 4096)

Note: DO NOT protect your key with a passphrase, otherwise you'll get an error during its addition to the Jelastic dashboard.

  • Then you should generate a certificate request based on the prepared key. Create it as follows:

req -config {config_path} -new -key {keyname} -out {filename}

where

{config_path} - path to the openssl.cnf configuration file, located in the directory with extracted OpenSSL files (specified according to the C:\path\to\openssl.cnf format)
{keyname} - your server key name (the one you’ve generated in the previous step, server.key in our case)

{filename} - desired name of the output request file with .csr extension (e.g. server.csr).

You’ll see a set of questions appear. Answer them in order to complete the certificate information with your data.

IMPORTANT: Note that the Common Name parameter value has to be equal to your purchased domain name, otherwise your certificate won't be validated.

For Linux/MacOS/FreeBSD

In case you don’t have the OpenSSL tool installed yet, get it with the appropriate command (according to your OS package manager) executed within your terminal. E.g. for Ubuntu/Debian Linux distribution use the following one:

sudo apt-get install openssl

When the installation process is completed, proceed to generation of the required files. All newly created with OpenSSL files will appear in the home directory of your local machine user by default.

  • First, you need to generate an SSH private server key. For that run the following command:

openssl genrsa -out {filename} {length}

where

{filename} - name of the output key file with .key extension (e.g. server.key)

{length} - private key length in bits (e.g. 4096)

Note: DO NOT protect your key with a passphrase, otherwise you'll get an error during its addition to the Jelastic dashboard.

  • Then you should generate a certificate request based on the prepared key. Create it as follows:

openssl req -new -key {keyname} -out {filename}

where

{keyname} - your server key name (the one you’ve generated in the previous step, server.key in our case)

{filename} - desired name of the output request file with .csr extension (e.g. server.csr).

You’ll see a set of questions appear. Answer them in order to complete the certificate information with your data.

IMPORTANT: Note that the Common Name parameter value has to be equal to your purchased domain name, otherwise your certificate won't be validated.

3. Send the Certificate Request you’ve received to your preferred Certificate Authority (CA) company for signing.

You can also sign certificates yourself. Follow this link to see the detailed instruction.

4. The chosen CA checks the identity of the domain owner and (if everything is ok) sends the Intermediate certificate and Domain certificate back to you.

Once you’ve received all the required files, you can proceed to configuring your environment.

Adjust Environment Topology

In order to be secured with a Custom SSL certificate, your environment should have custom domain and Public IP address attached to your application server.

Note:

  • for .NETPython and Node.js applications, your environment should also include the NGINX-balancer server. In this case, the external IP address should be attached to the balancer instead of application server as NGINX becomes the entry point of your app
  • for the Docker®-based environments, only the Jelastic SSL option is available currently

1. Log into the Jelastic dashboard and create a New environment (or click the Change environment topology button for an existing one).

2. In the opened Environment Topology dialog, click on the SSL switcher above the servers blocks and check if all the Custom SSL requirements are fulfilled (i.e. if all the options in the requirements list are marked with a green tick).

If they are not, Jelastic can help you to Adjust your environment in just a one click. For that select the appropriate button next to the list of requirements and your environment topology will be instantly tuned according to them.

To complete the adjustment, click Create for a new environment or click on Apply in case you’ve edited the existing one.

Domain Name and A Record Settings

Now you need to set an A Record in order to point your custom domain name to the Public IP address of your application.

1. Select the additional button for a node with the external IP attached in your environment (i.e. for the NGINX-balancer server in case of .NET/Python/Node.js usage, or for the application server in all other cases).

You’ll see the list of IPs, wherein the second one is the required Public IP address. Click on it to select the whole line and copy the digits to your clipboard.

2. Then, navigate to DNS Manager of the chosen domain registrar system (the one you’ve used for your custom domain name purchase) and set an A Record within it.

Additional information and a detailed example can be found in the appropriate document (starting at the 5th step of the Domain Name and A Record Settings section).

Upload Certificate to the Environment

The last step you need to perform, is to upload the certificate files to your Jelastic environment.

1. Click Settings for the configured environment.

2. In the opened tab, choose the Custom SSL option within the left-hand list.

Upload Server key, Intermediate certificate (CA) and Domain certificate into the appropriate fields. Click Save.

When the servers in your environment are automatically restarted, let’s ensure everything works properly. For that, enter the binded custom domain name (or the attached external IP address) into your browser’s address bar with https:// connection protocol specified instead of the default http:// one. Your application should be opened without any problems.

That's all! Now you can be confident all the received/sent by your application data is secured and encrypted.