|
| 1 | +--- |
| 2 | +myst: |
| 3 | + html_meta: |
| 4 | + description: Add a custom SSL certificate to your Hypernode account and link it |
| 5 | + to one or more Hypernodes. Includes Cloudflare Origin CA certificates. |
| 6 | + title: How to use a custom SSL certificate on Hypernode? |
| 7 | +--- |
| 8 | + |
| 9 | +# How to Use a Custom SSL Certificate on Hypernode |
| 10 | + |
| 11 | +You can add an SSL certificate from another certificate authority to your Hypernode account via the Control Panel. This is useful when you already have a certificate that was not ordered through Hypernode. |
| 12 | + |
| 13 | +The Control Panel requires the certificate files in PEM format: |
| 14 | + |
| 15 | +- Private Key |
| 16 | +- Certificate |
| 17 | +- Certificate Authority |
| 18 | + |
| 19 | +## Add a Custom SSL Certificate to Your Account |
| 20 | + |
| 21 | +1. Log into your [Control Panel](https://my.hypernode.com/). |
| 22 | +1. Select SSL in the sidebar on the left. |
| 23 | +1. To add a new SSL certificate, click the **Add SSL** button on the right. |
| 24 | +1. Click **Add third party SSL certificate**. |
| 25 | +1. Fill in the Private Key, Certificate and Certificate Authority. Use .PEM files only. |
| 26 | +1. Click **Apply your SSL certificate**. |
| 27 | +1. Click **Details** and then **(Un)link to Hypernodes** to select one or more Hypernodes to link the certificate to. |
| 28 | + |
| 29 | +## Add a Custom SSL Certificate Directly to a Hypernode |
| 30 | + |
| 31 | +You can also add a custom SSL certificate directly to a Hypernode. Follow the steps below to do so: |
| 32 | + |
| 33 | +1. Log into your [Control Panel](https://my.hypernode.com/). |
| 34 | +1. Select the specific Hypernode from the overview. |
| 35 | +1. Click on your **Hypernode** and select **SSL:** under **Services**. |
| 36 | +1. To add a new SSL certificate, click the **Add SSL** button on the right. |
| 37 | +1. Click **Add third party SSL certificate**. |
| 38 | +1. Fill in the Private Key, Certificate and Certificate Authority. Use .PEM files only. |
| 39 | +1. Click **Apply your SSL certificate**. |
| 40 | + |
| 41 | +## Link a Custom SSL Certificate to a Hypernode |
| 42 | + |
| 43 | +If you already have a custom SSL certificate added to your account, you can link it to a specific Hypernode by following these steps: |
| 44 | + |
| 45 | +1. Log into your [Control Panel](https://my.hypernode.com/). |
| 46 | +1. Select the specific Hypernode from the overview. |
| 47 | +1. Click on your **Hypernode** and select **SSL:** under **Services**. |
| 48 | +1. Here you'll see an overview of the available SSL certificates. Click **Details** and then **(Un)link to Hypernodes** to link one or more Hypernodes to link the certificate to. |
| 49 | + |
| 50 | +## Check Which Custom SSL Certificates Are Linked to Your Hypernode |
| 51 | + |
| 52 | +If you want to check which custom SSL certificates are linked to a specific Hypernode, you can do so by following these steps: |
| 53 | + |
| 54 | +1. Log into your [Control Panel](https://my.hypernode.com/). |
| 55 | +1. Select the Hypernode from the overview. |
| 56 | +1. Click on your **Hypernode** and select **SSL:** under **Services**. |
| 57 | +1. You will now see an overview of all linked SSL certificates. |
| 58 | +1. Click **Details** to go the detail page. You can unlink the domain or delete the SSL certificate from here. |
| 59 | + |
| 60 | +## Use a Cloudflare Origin CA Certificate |
| 61 | + |
| 62 | +Cloudflare Origin CA certificates encrypt traffic between Cloudflare and your Hypernode. They are useful when your domain uses Cloudflare proxying and you want to use Cloudflare SSL/TLS mode **Full (Strict)**. For more information, see the [official Cloudflare Origin CA documentation](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/). |
| 63 | + |
| 64 | +```{warning} |
| 65 | +Cloudflare Origin CA certificates are only trusted by Cloudflare. Site visitors can get certificate warnings if they connect directly to your Hypernode, if you pause Cloudflare, or if you turn off proxying for a hostname that uses this certificate. |
| 66 | +``` |
| 67 | + |
| 68 | +### Create the Certificate in Cloudflare |
| 69 | + |
| 70 | +1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/). |
| 71 | +1. Select your account and domain. |
| 72 | +1. Go to **SSL/TLS** > **Origin Server**. |
| 73 | +1. On the **Origin Certificates** tab, click **Create Certificate**. |
| 74 | +1. Choose **Generate private key and CSR with Cloudflare**. |
| 75 | +1. Choose **ECC** as the private key type. Hypernode's Nginx and OpenSSL versions support ECC certificates, and ECC keeps the certificate and TLS handshake smaller. Use RSA if you specifically need RSA compatibility. |
| 76 | +1. Add the hostnames the certificate should cover, such as `example.com`, `www.example.com`, or `*.example.com`. |
| 77 | +1. Choose the certificate validity period. |
| 78 | +1. Click **Create**. |
| 79 | +1. Choose **PEM** as the key format. |
| 80 | +1. Copy the **Origin Certificate** and **Private Key** before closing the screen. Cloudflare does not show the private key again later. |
| 81 | + |
| 82 | +### Add the Cloudflare Certificate to Hypernode |
| 83 | + |
| 84 | +Add the certificate as a custom SSL certificate in the Hypernode Control Panel. Use this field mapping: |
| 85 | + |
| 86 | +| Hypernode field | Cloudflare value | |
| 87 | +| --------------------- | --------------------------------------------------------------------------- | |
| 88 | +| Private Key | The **Private Key** shown when you created the Origin CA certificate | |
| 89 | +| Certificate | The **Origin Certificate** shown when you created the Origin CA certificate | |
| 90 | +| Certificate Authority | The Cloudflare Origin CA root certificate in PEM format | |
| 91 | + |
| 92 | +Use the Cloudflare Origin CA root certificate that matches the certificate type you created: |
| 93 | + |
| 94 | +- [Cloudflare Origin ECC PEM](https://developers.cloudflare.com/ssl/static/origin_ca_ecc_root.pem) for ECC certificates. |
| 95 | +- [Cloudflare Origin RSA PEM](https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem) for RSA certificates. |
| 96 | + |
| 97 | +After applying the SSL certificate, link it to the correct Hypernode. If the certificate was added directly from the Hypernode SSL page, it is already linked to that Hypernode. |
| 98 | + |
| 99 | +### Set Cloudflare to Full (Strict) |
| 100 | + |
| 101 | +After the certificate is installed and linked in Hypernode, update the SSL/TLS encryption mode in Cloudflare: |
| 102 | + |
| 103 | +```{note} |
| 104 | +Only set **Full (Strict)** globally if all Cloudflare-proxied origin hosts in the zone use a valid Origin CA or publicly trusted certificate. If only this Hypernode uses the Origin CA certificate, configure **Full (Strict)** for the relevant hostname in Cloudflare. |
| 105 | +``` |
| 106 | + |
| 107 | +1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/). |
| 108 | +1. Select your account and domain. |
| 109 | +1. Go to **SSL/TLS** > **Overview**. |
| 110 | +1. Set **SSL/TLS encryption mode** to **Full (Strict)**. |
| 111 | + |
| 112 | +Test the website through the Cloudflare-proxied hostname after changing this setting. |
| 113 | + |
| 114 | +## How to Generate a Certificate Signing Request on Nginx Using OpenSSL |
| 115 | + |
| 116 | +Log into your Hypernode with SSH and run the following command: |
| 117 | + |
| 118 | +```bash |
| 119 | +openssl req -new -newkey rsa:2048 -nodes -keyout myserver.key -out myserver.csr |
| 120 | +``` |
| 121 | + |
| 122 | +```{note} |
| 123 | +Replace `myserver` with the domain name you're securing. For example, if your domain name is `mydomain.com`, use `mydomain.key` and `mydomain.csr`. |
| 124 | +``` |
| 125 | + |
| 126 | +This command creates two files: the private key file for decrypting the SSL certificate and the certificate signing request (CSR) file used to apply for your SSL certificate. |
| 127 | + |
| 128 | +Enter the requested information: |
| 129 | + |
| 130 | +- **Common Name (CN):** The fully-qualified domain name, or URL, you want to secure. |
| 131 | +- **Organization (O):** The legally registered name for your business. If you are enrolling as an individual, enter the certificate requestor's name. |
| 132 | +- **Organization Unit (OU):** If applicable, enter the DBA (Doing Business As) name. |
| 133 | +- **City or Locality (L):** Name of the city where your organization is registered or located. Do not abbreviate. |
| 134 | +- **State or Province (S):** Name of the state or province where your organization is located. Do not abbreviate. |
| 135 | +- **Country (C):** The two-letter International Organization for Standardization (ISO) country code for where your organization is legally registered. |
| 136 | + |
| 137 | +If you are requesting a wildcard certificate, add an asterisk (`*`) to the left of the common name where you want the wildcard, for example `*.mydomain.com`. Do not use the asterisk in the private key or CSR file names, because `*` is a special character in shells. Use file names like `wildcard.mydomain.com.key` and `wildcard.mydomain.com.csr` instead. |
| 138 | + |
| 139 | +If you do not want to enter a password for this SSL certificate, leave the passphrase field blank. |
| 140 | + |
| 141 | +Your `.csr` file will then be created. Open the CSR file with a text editor and copy and paste it, including the `BEGIN` and `END` tags, into the certificate order form. |
| 142 | + |
| 143 | +Save the generated `.key` file. You will need it when installing your SSL certificate in Nginx. |
0 commit comments