Skip to content

Commit aba60f8

Browse files
authored
Merge pull request #505 from ByteInternet/docs/custom-ssl-origin-ca
ssl: Add specific article for custom certs
2 parents 2398b98 + 90c734c commit aba60f8

4 files changed

Lines changed: 171 additions & 137 deletions

docs/best-practices/cdn/how-to-use-cloudflare-with-hypernode.md

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ redirect_from:
88
- /en/best-practices/cdn/how-to-use-cloudflare-with-hypernode/
99
---
1010

11-
<!-- source: https://support.hypernode.com/en/best-practices/cdn/how-to-use-cloudflare-with-hypernode/ -->
12-
1311
# How to Use Cloudflare with Hypernode
1412

1513
To get started with Cloudflare on your Hypernode create an account at Cloudflare and change the nameservers of your domain to the Cloudflare nameservers.
@@ -30,7 +28,7 @@ Cloudflare blocks threats, limits abusive bots and crawlers from wasting your ba
3028

3129
To setup Cloudflare for your shop, use the following steps:
3230

33-
1. Create an [account at Cloudflare](https://support.cloudflare.com/hc/en-us/articles/201720164-How-do-I-sign-up-for-CloudFlare-)
31+
1. Create an [account at Cloudflare](https://developers.cloudflare.com/fundamentals/account/create-account/)
3432
1. Login to your [Cloudflare admin panel](https://www.cloudflare.com/a/login)
3533
1. Turn on caching and other performance optimization.
3634
1. Copy all DNS Records from your current domain provider to the Cloudflare DNS admin
@@ -42,23 +40,19 @@ To setup Cloudflare for your shop, use the following steps:
4240
Mirage mobile image optimization
4341
1. Test, test some more and after that, test it all again.
4442

45-
## Configuration of Cloudflare for Magento
46-
47-
Cloudflare provides [a very large knowledge base](https://support.cloudflare.com/hc/en-us) for dealing with a wide variety of issues and optimizations.
48-
49-
For using Cloudflare with Magento, please check [the article on their knowledge base](https://support.cloudflare.com/hc/en-us/articles/203904600-Using-CloudFlare-with-Magento) and their [Page Rules and Magento optimization article](https://www.cloudflare.com/features-page-rules/optimize-magento/).
50-
5143
## Using SSL With Cloudflare
5244

5345
Cloudflare offers SSL offloading. You can upload your SSL certificates to Cloudflare to make use of SSL. If you choose to do this, always manually order your SSL certificates so you can use the same certificate on both the Cloudflare servers and the Hypernode.
5446

5547
If you use manual SSL certificates, make sure you monitor when your certificate is about to expire.
5648

57-
## Redirection From HTTP to HTTP
49+
You can also use a [Cloudflare Origin CA certificate](../../hypernode-platform/ssl/how-to-use-a-custom-ssl-certificate-on-hypernode.md#use-a-cloudflare-origin-ca-certificate) to encrypt traffic between Cloudflare and your Hypernode using a certificate signed by Cloudflare. This way you can use Cloudflare SSL/TLS mode **Full (Strict)** without having to worry about your certificate expiring.
50+
51+
## Redirection From HTTP to HTTPS
5852

5953
Redirecting from HTTP to HTTPS can cause a *Too many redirects* error. This error comes from a cached redirect that is served on both HTTP and HTTPS connection, causing the site to redirect from HTTP to HTTPS.
6054

61-
To redirect all requests to HTTPS when using Cloudflare SSL, you should instead use [a page rule with the Always Use HTTPS action.](https://support.cloudflare.com/hc/en-us/articles/203295200-End-to-end-HTTPS-with-Cloudflare-Part-2-SSL-certificates)
55+
To redirect all requests to HTTPS when using Cloudflare SSL, you should instead use [the Always Use HTTPS](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/always-use-https/#encrypt-all-visitor-traffic) setting.
6256

6357
## Blocking IP’s When Using Cloudflare
6458

@@ -70,16 +64,6 @@ For example have a look at [our documentation about blocking or whitelisting IP
7064

7165
Another option is to configure a blocklist in the [Cloudflare Admin](https://www.cloudflare.com/a/login).
7266

73-
## Don’t Use Railgun on Hypernodes
74-
75-
Cloudflare provides a service called [Railgun.](https://blog.cloudflare.com/cacheing-the-uncacheable-cloudflares-railgun-73454/) The key to this service is a local proxy daemon that sends all requests from Cloudflare through a tunnel to the proxy instance that does the actual web requests.
76-
77-
Our tests with Railgun on Hypernodes showed a performance gain of just a few milliseconds, making it not a very significant performance optimization when working with Magento.
78-
79-
As we do not support Railgun (yet), we’ve seen some implementations running the Railgun daemon on a separate server. Doing so is not recommended as it will make all HTTP requests from Cloudflare arrive from the same remote IP.
80-
81-
When someone is trying to brute force your server or in case of an attack, our protection mechanisms will block the attacker. When you use Railgun, our mechanisms will not block the remote IP but block the IP of the Railgun daemon instead, blocking all traffic coming from Cloudflare and therefore block all visitors to your shop.
82-
8367
## 520 Errors From Cloudflare
8468

8569
It can happen that Cloudflare returns a 520 error stating "Web server is returning an unknown error".
Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
myst:
3+
html_meta:
4+
description: Add a custom SSL certificate to your Hypernode account and link it
5+
to one or more Hypernodes. Includes Cloudflare Origin CA certificates.
6+
title: How to use a custom SSL certificate on Hypernode?
7+
---
8+
9+
# How to Use a Custom SSL Certificate on Hypernode
10+
11+
You can add an SSL certificate from another certificate authority to your Hypernode account via the Control Panel. This is useful when you already have a certificate that was not ordered through Hypernode.
12+
13+
The Control Panel requires the certificate files in PEM format:
14+
15+
- Private Key
16+
- Certificate
17+
- Certificate Authority
18+
19+
## Add a Custom SSL Certificate to Your Account
20+
21+
1. Log into your [Control Panel](https://my.hypernode.com/).
22+
1. Select SSL in the sidebar on the left.
23+
1. To add a new SSL certificate, click the **Add SSL** button on the right.
24+
1. Click **Add third party SSL certificate**.
25+
1. Fill in the Private Key, Certificate and Certificate Authority. Use .PEM files only.
26+
1. Click **Apply your SSL certificate**.
27+
1. Click **Details** and then **(Un)link to Hypernodes** to select one or more Hypernodes to link the certificate to.
28+
29+
## Add a Custom SSL Certificate Directly to a Hypernode
30+
31+
You can also add a custom SSL certificate directly to a Hypernode. Follow the steps below to do so:
32+
33+
1. Log into your [Control Panel](https://my.hypernode.com/).
34+
1. Select the specific Hypernode from the overview.
35+
1. Click on your **Hypernode** and select **SSL:** under **Services**.
36+
1. To add a new SSL certificate, click the **Add SSL** button on the right.
37+
1. Click **Add third party SSL certificate**.
38+
1. Fill in the Private Key, Certificate and Certificate Authority. Use .PEM files only.
39+
1. Click **Apply your SSL certificate**.
40+
41+
## Link a Custom SSL Certificate to a Hypernode
42+
43+
If you already have a custom SSL certificate added to your account, you can link it to a specific Hypernode by following these steps:
44+
45+
1. Log into your [Control Panel](https://my.hypernode.com/).
46+
1. Select the specific Hypernode from the overview.
47+
1. Click on your **Hypernode** and select **SSL:** under **Services**.
48+
1. Here you'll see an overview of the available SSL certificates. Click **Details** and then **(Un)link to Hypernodes** to link one or more Hypernodes to link the certificate to.
49+
50+
## Check Which Custom SSL Certificates Are Linked to Your Hypernode
51+
52+
If you want to check which custom SSL certificates are linked to a specific Hypernode, you can do so by following these steps:
53+
54+
1. Log into your [Control Panel](https://my.hypernode.com/).
55+
1. Select the Hypernode from the overview.
56+
1. Click on your **Hypernode** and select **SSL:** under **Services**.
57+
1. You will now see an overview of all linked SSL certificates.
58+
1. Click **Details** to go the detail page. You can unlink the domain or delete the SSL certificate from here.
59+
60+
## Use a Cloudflare Origin CA Certificate
61+
62+
Cloudflare Origin CA certificates encrypt traffic between Cloudflare and your Hypernode. They are useful when your domain uses Cloudflare proxying and you want to use Cloudflare SSL/TLS mode **Full (Strict)**. For more information, see the [official Cloudflare Origin CA documentation](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/).
63+
64+
```{warning}
65+
Cloudflare Origin CA certificates are only trusted by Cloudflare. Site visitors can get certificate warnings if they connect directly to your Hypernode, if you pause Cloudflare, or if you turn off proxying for a hostname that uses this certificate.
66+
```
67+
68+
### Create the Certificate in Cloudflare
69+
70+
1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/).
71+
1. Select your account and domain.
72+
1. Go to **SSL/TLS** > **Origin Server**.
73+
1. On the **Origin Certificates** tab, click **Create Certificate**.
74+
1. Choose **Generate private key and CSR with Cloudflare**.
75+
1. Choose **ECC** as the private key type. Hypernode's Nginx and OpenSSL versions support ECC certificates, and ECC keeps the certificate and TLS handshake smaller. Use RSA if you specifically need RSA compatibility.
76+
1. Add the hostnames the certificate should cover, such as `example.com`, `www.example.com`, or `*.example.com`.
77+
1. Choose the certificate validity period.
78+
1. Click **Create**.
79+
1. Choose **PEM** as the key format.
80+
1. Copy the **Origin Certificate** and **Private Key** before closing the screen. Cloudflare does not show the private key again later.
81+
82+
### Add the Cloudflare Certificate to Hypernode
83+
84+
Add the certificate as a custom SSL certificate in the Hypernode Control Panel. Use this field mapping:
85+
86+
| Hypernode field | Cloudflare value |
87+
| --------------------- | --------------------------------------------------------------------------- |
88+
| Private Key | The **Private Key** shown when you created the Origin CA certificate |
89+
| Certificate | The **Origin Certificate** shown when you created the Origin CA certificate |
90+
| Certificate Authority | The Cloudflare Origin CA root certificate in PEM format |
91+
92+
Use the Cloudflare Origin CA root certificate that matches the certificate type you created:
93+
94+
- [Cloudflare Origin ECC PEM](https://developers.cloudflare.com/ssl/static/origin_ca_ecc_root.pem) for ECC certificates.
95+
- [Cloudflare Origin RSA PEM](https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem) for RSA certificates.
96+
97+
After applying the SSL certificate, link it to the correct Hypernode. If the certificate was added directly from the Hypernode SSL page, it is already linked to that Hypernode.
98+
99+
### Set Cloudflare to Full (Strict)
100+
101+
After the certificate is installed and linked in Hypernode, update the SSL/TLS encryption mode in Cloudflare:
102+
103+
```{note}
104+
Only set **Full (Strict)** globally if all Cloudflare-proxied origin hosts in the zone use a valid Origin CA or publicly trusted certificate. If only this Hypernode uses the Origin CA certificate, configure **Full (Strict)** for the relevant hostname in Cloudflare.
105+
```
106+
107+
1. Log into the [Cloudflare dashboard](https://dash.cloudflare.com/).
108+
1. Select your account and domain.
109+
1. Go to **SSL/TLS** > **Overview**.
110+
1. Set **SSL/TLS encryption mode** to **Full (Strict)**.
111+
112+
Test the website through the Cloudflare-proxied hostname after changing this setting.
113+
114+
## How to Generate a Certificate Signing Request on Nginx Using OpenSSL
115+
116+
Log into your Hypernode with SSH and run the following command:
117+
118+
```bash
119+
openssl req -new -newkey rsa:2048 -nodes -keyout myserver.key -out myserver.csr
120+
```
121+
122+
```{note}
123+
Replace `myserver` with the domain name you're securing. For example, if your domain name is `mydomain.com`, use `mydomain.key` and `mydomain.csr`.
124+
```
125+
126+
This command creates two files: the private key file for decrypting the SSL certificate and the certificate signing request (CSR) file used to apply for your SSL certificate.
127+
128+
Enter the requested information:
129+
130+
- **Common Name (CN):** The fully-qualified domain name, or URL, you want to secure.
131+
- **Organization (O):** The legally registered name for your business. If you are enrolling as an individual, enter the certificate requestor's name.
132+
- **Organization Unit (OU):** If applicable, enter the DBA (Doing Business As) name.
133+
- **City or Locality (L):** Name of the city where your organization is registered or located. Do not abbreviate.
134+
- **State or Province (S):** Name of the state or province where your organization is located. Do not abbreviate.
135+
- **Country (C):** The two-letter International Organization for Standardization (ISO) country code for where your organization is legally registered.
136+
137+
If you are requesting a wildcard certificate, add an asterisk (`*`) to the left of the common name where you want the wildcard, for example `*.mydomain.com`. Do not use the asterisk in the private key or CSR file names, because `*` is a special character in shells. Use file names like `wildcard.mydomain.com.key` and `wildcard.mydomain.com.csr` instead.
138+
139+
If you do not want to enter a password for this SSL certificate, leave the passphrase field blank.
140+
141+
Your `.csr` file will then be created. Open the CSR file with a text editor and copy and paste it, including the `BEGIN` and `END` tags, into the certificate order form.
142+
143+
Save the generated `.key` file. You will need it when installing your SSL certificate in Nginx.

docs/hypernode-platform/ssl/how-to-use-ssl-certificates-on-your-hypernode-when-ordered-via-hypernode-com.md

Lines changed: 3 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ SSL sends information across the internet encrypted so that only the intended re
2121
When you have ordered your Hypernode on Hypernode.com you have three options to use SSL on your Hypernode plan(s):
2222

2323
- Buy an SSL certificate via Hypernode.
24-
- Upload your own SSL certificate
24+
- [Upload your own SSL certificate](../ssl/how-to-use-a-custom-ssl-certificate-on-hypernode.md)
2525
- Request a certificate using Let’s Encrypt
2626

2727
## Buy an SSL Certificate Via Hypernode (Recommended)
@@ -59,53 +59,9 @@ Please note! To avoid being charged for another year, please make sure to cancel
5959

6060
If the certificate has already been renewed, Hypernode has already incurred costs for the renewal of the SSL certificate. Approving or not approving this request does not change that. The costs for the certificate will be added to the upcoming invoice.
6161

62-
## Add a Third Party SSL Certificate to Your Account
62+
## Upload Your Own SSL Certificate
6363

64-
You can add your SSL certificate to your account via your Control Panel. Follow the steps below:
65-
66-
1. Log into your [Control Panel](https://my.hypernode.com/).
67-
1. Select SSL in the sidebar on the left:
68-
![SSL side bar screenshot](_res/sidebar-ssl-selection.png)
69-
1. To add a new SSL certificate, click the **Add SSL** button on the right.
70-
1. Click **Add third party SSL certificate**.
71-
1. Fill in the Private Key, Certificate and Certificate Authority (only .PEM files).
72-
1. Click **Apply your SSL certificate**. You'll then go to this page:
73-
![SSL certificates page screenshot](_res/ssl-certificate-page.png)
74-
1. Click **Details** and then **(Un)link to Hypernodes** to select one or more Hypernodes to link the certificate to.
75-
76-
### Add a Third Party SSL Certificate Directly to a Hypernode
77-
78-
You can also add a third pardy SSL certificate directly to a Hypernode. Follow the steps below to do so:
79-
80-
1. Log into your [Control Panel](https://my.hypernode.com/).
81-
1. Select the specific Hypernode from the overview.
82-
1. Click on your **Hypernode** and click **SSL:** under **Services**.
83-
![SSL side bar list screenshot](_res/sidebar-list.png)
84-
1. To add a new SSL certificate, click the **Add SSL** button on the right.
85-
1. Click **Add third party SSL certificate**.
86-
1. Fill in the Private Key, Certificate and Certificate Authority (only .PEM files).
87-
1. Click **Apply your SSL certificate**.
88-
89-
### Link a Third Party SSL Certificate to a Hypernode
90-
91-
If you already have a third party SSL added to your account, you can link it to a specific Hypernode by following these steps:
92-
93-
1. Log into your [Control Panel](https://my.hypernode.com/).
94-
1. Select the specific Hypernode from the overview.
95-
1. Click on your **Hypernode** and click **SSL:** under **Services**.
96-
![SSL side bar list screenshot](_res/sidebar-list.png)
97-
1. Here you'll see an overview of the available SSL certificates. Click **Details** and then **(Un)link to Hypernodes** to link one or more Hypernodes to link the certificate to.
98-
99-
### Check Which Third Party Certificates Are Linked to Your Hypernode
100-
101-
If you want to check which Third Party certificates are linked to a specific Hypernode, you can do so by following these steps:
102-
103-
1. Log into your [Control Panel](https://my.hypernode.com/).
104-
1. Select the Hypernode from the overview.
105-
1. Click on your **Hypernode** and click **SSL:** under **Services**.
106-
![SSL side bar list screenshot](_res/sidebar-list.png)
107-
1. You will now see an overview of all linked SSL certificates.
108-
1. Click **Details** to go the detail page. You can unlink the domain or delete the SSL certificate from here.
64+
If you already have an SSL certificate from another certificate authority, follow [How to Use a Custom SSL Certificate on Hypernode](../ssl/how-to-use-a-custom-ssl-certificate-on-hypernode.md).
10965

11066
## Use Let’s Encrypt
11167

@@ -208,39 +164,3 @@ After configuring your shop to only use HTTPS, please do not forget to check HTT
208164
- Payment providers like Adyen
209165
- Stock providers like Picqer
210166
- Google Analytics and Google Search Console
211-
212-
## How to Generate Certificate Signing Request on Nginx using OpenSSL
213-
214-
Log into your Hypernode with SSH and run the following command:
215-
216-
```bash
217-
openssl req -new -newkey rsa:2048 -nodes -keyout myserver.key -out myserver.csr
218-
```
219-
220-
**Note:** Replace yourdomain with the domain name you're securing. For example, if your domain name is mydomain.com, you would type mydomain.key and mydomain.csr where server is the name of your server.
221-
222-
This will begin the process of generating two files: the Private-Key file for the decryption of your SSL Certificate, and a certificate signing request (CSR) file used to apply for your SSL Certificate.
223-
224-
Enter the requested information:
225-
226-
**- Common Name (CN):** The fully-qualified domain name, or URL, you want to secure.
227-
228-
If you are requesting a Wildcard certificate, add an asterisk (\*) to the left of the common name where you want the wildcard, for example `*.mydomain.com`.
229-
230-
**- Organization (O):** The legally-registered name for your business. If you are enrolling as an individual, enter the certificate requestor's name.
231-
232-
**- Organization Unit (OU):** If applicable, enter the DBA (Doing Business As) name.
233-
234-
**- City or Locality (L):** Name of the city where your organization is registered/located. Do not abbreviate.
235-
236-
**- State or Province (S):** Name of the state or province where your organization is located. Do not abbreviate.
237-
238-
**- Country (C):** The two-letter International Organization for Standardization (ISO) format country code for where your organization is legally registered.
239-
240-
**Note:** If you do not want to enter a password for this SSL, you can leave the Passphrase field blank.
241-
242-
Your `.csr` file will then be created.
243-
244-
Open the CSR file with a text editor and copy and paste it (including the BEGIN and END tags) into the Certificate order form.
245-
246-
Save (backup) the generated .key file as it will be required later when installing your SSL certificate in Nginx.

0 commit comments

Comments
 (0)