Skip to main content

About server certificates

A server certificate is an x509 certificate that you import into your Numspot account to prove the identity of your services and encrypt the connections with your users. Its main use is SSL (Secure Sockets Layer) termination on a load balancer: the load balancer presents the certificate to clients and decrypts requests before forwarding them to your VM (Virtual Machine).

Server certificates are managed at the account level and referenced in other services by their NRN (Numspot Resource Name).

info

Server certificate management is not available from the Numspot console: it is performed via the API or Terraform.

Content of a server certificate​

When creating a server certificate, you provide the following elements, all PEM-encoded:

  • the x509 certificate, which contains the public key of the server and the signature of the certification authority;
  • the corresponding private key;
  • if your certificate is not directly signed by a root authority, the chain of certificates of the intermediate certification authorities. Concatenate all the certificates in the correct order: the first one must be that of your certificate's authority, the second one that of the first one's authority, and so on.

The private key must be an RSA key in PKCS1 format. To check this, open the PEM file and make sure its header reads BEGIN RSA PRIVATE KEY.

warning

The private key must not be protected by a password or a passphrase.

Identification and metadata​

Each server certificate is identified by:

  • a name, unique within your account, set at creation time;
  • a path, optional, which indicates the position of the certificate within your organization;
  • an NRN, generated by Numspot at creation time, which references the certificate in other services.

The name and the path can be updated at any time. Viewing your server certificates also returns the upload date and the expiration date of each certificate.

warning

Neither the certificate nor the private key can be retrieved after the upload. Keep a secure local copy of these files.

Use with a load balancer​

To enable SSL termination on a load balancer, import your server certificate and then reference its NRN when configuring an HTTPS or SSL listener. For more information, see the SSL redirects section of the load balancer concepts page.

The certificate used by a listener can be replaced at any time, for example when the certificate is renewed.

Was this page helpful?