How to Configure HTTPS Certificates on a CDN: Origin Protocols, Certificate Types, and Common Pitfalls
Once a website is behind a CDN, HTTPS splits into two segments: user → CDN and CDN → origin. Many people only configure the first segment; the second is missing or misconfigured, causing broken pages and certificate errors. This article explains CDN certificate configuration clearly.
1. First, Distinguish the Two Segments and Two Certificate Roles
Behind a CDN, users no longer connect directly to your server — they connect to CDN edge nodes. So HTTPS involves two segments:
- Edge node ↔ user: needs an "edge certificate";
- Edge node ↔ origin server: involves the protocol and certificate used during "origin fetch".
Correspondingly, certificates play two roles:
- Edge certificate: deployed on CDN nodes and shown to users. With a CDN-managed free certificate, the CDN usually obtains and manages it automatically;
- Origin certificate: deployed on your server for the CDN to verify when fetching. If the origin has no certificate, choose HTTP origin fetch.
Mixing these two concepts up is the most common cause of misconfiguration. For how CDNs work overall, see How CDNs Work.
2. Origin Protocol: Which of the Three to Choose
The origin protocol decides how the "CDN → origin" segment connects. There are usually three modes:
| Origin Protocol | Meaning | Pros | Cons |
|---|---|---|---|
| HTTP | CDN fetches origin in plaintext | No certificate needed on origin; simple | Middle segment not encrypted |
| HTTPS | CDN fetches origin over encryption | Fully encrypted end to end; most secure | Origin must have a valid certificate |
| Follow | Match whatever the user used | Both segments consistent | Easy to misconfigure |
Selection advice: choose HTTP origin fetch for the simplest setup (traffic inside the CDN network is low risk); choose HTTPS origin fetch for a fully secure chain; "follow" is only recommended when you are sure the origin protocol matches the edge. For higher-security setups, see CDN and SSL/TLS Configuration Best Practices.
3. Free Certificate vs Custom Certificate
The edge certificate mainly has two sources:
1. Free certificate (CDN-managed): obtained and auto-renewed by the CDN provider — most CDNs offer one-click free certificates. Ideal for the vast majority of personal and small sites: zero cost and no renewal worry. For the general way to obtain free certificates, see Let's Encrypt Auto-Renewal.
2. Custom certificate (uploaded): upload a certificate you bought from a CA. Suitable when you need higher validation (OV/EV), a stronger corporate image, or specific brands/wildcards/multi-domain. How to choose certificate types: SSL Certificate Types Guide.
Comparison:
| Aspect | Free Certificate | Custom Certificate |
|---|---|---|
| Cost | 0 | Annual fee |
| Renewal | Automatic | You manage it |
| Validation | Usually DV | Can be OV/EV |
| Best for | Personal & small sites | Enterprises, trust-sensitive sites |
4. Configuration Steps (Typical CDN)
- Enable CDN acceleration: add your domain to the CDN and configure CNAME resolution — see Adding Your Website to a CDN;
- Enable HTTPS: turn on the "free certificate" or upload a custom one in the CDN console so the user-to-edge segment uses HTTPS;
- Configure origin: pick the origin protocol (beginners: start with HTTP) and fill in the correct origin address and port;
- Set up redirect: configure HTTP → HTTPS automatic redirect (301/308) to consolidate on 443;
- Verify: open the https domain in a browser to confirm the padlock, and use an online checker to confirm the certificate chain is complete.
5. Common Pitfalls and Troubleshooting
Pitfall 1: Certificate/domain mismatch. Users access www.example.com but the certificate is for example.com. Fix: ensure the certificate domain configured on the CDN exactly matches the access domain (including www).
Pitfall 2: Mixed content. The page is HTTPS but references HTTP images, scripts, or APIs, and the browser blocks them. Fix: switch all resources to https or relative paths.
Pitfall 3: Origin protocol doesn't match the origin. You chose HTTPS origin fetch but the origin has no certificate, so the CDN returns 502/525. Fix: confirm the origin's 443 certificate works, or switch back to HTTP origin fetch.
Pitfall 4: Incomplete certificate chain. The browser reports "certificate not trusted", usually because the intermediate certificate was omitted when uploading. Fix: concatenate the leaf, intermediate, and root certificates in order.
Pitfall 5: Stale certificate cached. After replacing a certificate, some regions still report errors, possibly due to edge or client caching. Fix: wait for propagation, or clear the browser cache and retry in an incognito window.
6. FAQ
Q1: Do I have to use HTTPS origin fetch? No. HTTP origin fetch is low risk in a CDN context (the user-to-CDN segment is encrypted), and many production sites use it for simplicity. Consider HTTPS origin only for highly sensitive use cases like finance.
Q2: How long do CDN free certificates last? Usually around 90 days, auto-renewed by the CDN, so you barely notice expiration.
Q3: Does HTTPS origin fetch slow things down? There is a little extra handshake overhead, usually negligible. CDN-to-origin paths typically ride internal or high-quality networks.
Q4: Browser still errors after configuration — what now? Work through the pitfalls in order: domain match → certificate chain → mixed content → origin protocol → cache.
7. Summary
One line: CDN HTTPS has two segments — user-to-edge uses the edge certificate, edge-to-origin uses the origin protocol; beginners get the simplest setup with a free certificate plus HTTP origin fetch, then troubleshoot via certificate match, chain, and mixed content. To study CDN systematically, bookmark the CDN Network category.