Generate a Let's Encrypt Cert for Your Domain

Discover how you can generate a free TLS certificate issued by Let's Encrypt and automatically managed by Azion to secure your application.

View as Markdown

Web applications that use the HTTPS protocol require a Certificate Manager. When you redirect your traffic to Azion, you have the option to generate a Let’s Encrypt™ certificate, which is a free and secure way to encrypt data for your application. Azion automates the issuance, renewal, and deactivation of this TLS certificate through an internal certificate management solution.

Note — Let’s Encrypt certificates cross-signed by IdenTrust expired on September 30th, 2024. Devices and applications using the Let’s Encrypt certificate that uses IdenTrust will become invalid. This could impact the functionality of devices and applications utilizing these certificates, mainly users of older Android devices (pre-7.1). It’ll be necessary to take the following actions:

  • For users of Let’s Encrypt Certificates with IdenTrust: you must migrate to the new Let’s Encrypt signing technology or an Azion edge certificate.
  • For users of other types of Let’s Encrypt: no immediate action is necessary, considering other certificates remain unaffected with this update, since the problem is caused by outdated certificate chains on the device.
  • For user with applications using Let’s Encrypt in Azion: no action needed. Certificates are automatically updated, although an affected device must have its CAs updated as well.

Before you begin

Azion generates Let’s Encrypt certificates for domains and subdomains registered in the Domain Name System (DNS). Domains can be acquired and registered into DNS zones through a third-party DNS provider, such as GoDaddy or Amazon AWS.

For the purposes of this guide, assume that the fully-qualified domain name (FQDN) that you want to generate a Let’s Encrypt certificate for is a CNAME record www.yourdomain.org under a yourdomain.org DNS zone.

Azion support for Let’s Encrypt certificates is entirely subject to the availability and limitations defined by the Let’s Encrypt service, as outlined in its official documentation.

Generating a Let’s Encrypt certificate

You may choose to generate a Let’s Encrypt certificate for domain records hosted in Edge DNS or in the external DNS provider of your top-level domain.

To that end, you’ll have to prepare your DNS server and register records for Azion to be able to create and manage your Let’s Encrypt certificate.

There is also the possibility to create a Let’s Encrypt certificate via Azion CLI.

Option 1: Preparing DNS entry on Azion Edge DNS

Azion allows you to host DNS zones by redirecting the DNS resolution of a domain to Edge DNS. When using Edge DNS, all configurations needed are made through Azion interface.

To create a DNS zone for a domain entry www.yourdomain.org in Edge DNS:

  1. Access Azion Console > Edge DNS.
  2. If you don’t have an active zone, click the + Zone button.
  3. Give your zone an easy-to-remember name.
  4. Indicate the FQDN as recorded in the DNS. Example: yourdomain.org.
  5. Click the Save button.

For more information on how to redirect your domain’s authoritative DNS servers, check the Edge DNS documentation.

Once your DNS resolution has been successfully redirected and is hosted in Edge DNS, you can create a new CNAME record for the domain by following the steps:

  1. Still on the Edge DNS page, select the desired zone.
  2. Navigate to the Records tab.
  3. Click the + Record button.
  4. Under Name, create a hostname or subdomain.
  5. Under Record Type, select CNAME - Canonical name.
  6. Under Value, enter the Azion-provided domain address in FQDN format. Example: xxxxxxxxxx.map.azionedge.net
    • If you don’t have a domain, skip to section Creating a domain for more information.
  7. Set the TTL and Policy as desired.
  8. Click the Save button.

If the CNAME entry listed in your Azion domain has been created in your Edge DNS zone, Azion will automatically verify the domain authenticity and the Let’s Encrypt certificate will become active. Go to the section Checking the status of Let’s Encrypt certificates for more information on certificate statuses.

Option 2: Preparing DNS entry with an external DNS provider

If you have a domain registered in an external DNS zone, Azion will verify the domain authenticity in an external DNS provider by completing Let’s Encrypt method called DNS-01 ACME client challenge to issue the certificate.

If you already have a zone in Edge DNS, the DNS-01 challenge will be completed automatically.

To allow the DNS-01 challenge to occur:

  1. Access your DNS provider’s website.
  2. Navigate to the DNS management area.
  3. Create a CNAME record for each domain that you want to use with the certificate. Make sure this CNAME record matches the value you’ll enter in the CNAME field when you create your Azion domain. For example:www.yourdomain.org.
  4. Add a new record to your domain as follows:
NameValueType
_acme-challenge.<your domain>

For example:
_acme-challenge.www.yourdomain.org		<your domain>.letsencrypt.azion.com

Example:
www.yourdomain.org.letsencrypt.azion.com		CNAME
  1. Repeat steps 3 and 4 for every CNAME you intend to add to your domain.
  2. Save your settings.

Now that the challenge can take place, the next step is to bind your domain to an Application.

Configuring your domain

Below are steps for adding a certificate to your application. There are separate instructions for the legacy Domains settings and the new Workloads product.

If you’re not sure which steps apply to your account, see the Verify Your Account Migration to API v4 guide to determine if your account has already been migrated.

To create a Workload, you must have an application. If you haven’t created an application yet, check the Build an application documentation.

Once you have an application, you need to create a Workload and list the CNAMEs that you want to secure with the Let’s Encrypt certificate. To do so, follow these steps:

  1. Access Azion Console > Workloads.
  2. Click the + Workload button.
  3. Name your domain. Example: Domain.
  4. Under the Subdomain and Domain fields, add the FQDN of the domain you created in the previous sections. Example: www.yourdomain.org.
  5. Under Applications, select the application you created.
  6. Under Digital Certificate, select the option Let’s Encrypt.
  7. Click the Save button.

The certificate will be issued using the DNS-01 validation method. For domains hosted on Edge DNS, validation is automatic. For domains on external DNS providers, make sure the _acme-challenge CNAME record is correctly configured.

Checking the status of Let’s Encrypt certificates

You can check the status of your Let’s Encrypt TLS certificate by following these steps:

  1. Access Azion Console > Certificate Manager.
  2. In your digital certificate list, you’ll see a new entry in the format Domain - Let's Encrypt <timestamp>.

The status on the right of the list shows you whether the certificate has been issued. An Active certificate has been verified and issued successfully. A Pending status means the certificate is still undergoing checks in Azion’s internal certificate manager.

If the Pending status remains for over 48 hours, you must check if the CNAME records you listed in the section Creating a domain are correct.

For more information on issuing Let’s Encrypt certificates, visit the Certificate Manager for Secure reference.

Managing a Let’s Encrypt certificate

Once the certificate undergoes DNS validation, it will not require manual renewal upon expiration, which occurs after 90 days. Deactivation will only happen if the certificate is deleted or if the associated domain is removed from Azion. Additionally, Let’s Encrypt certificates automatically managed by Azion are renewed 30 days prior to their expiration date, ensuring continuous service availability and maintaining the security of your applications.

To ensure that the certificate is renewed for domains hosted in external services, don’t delete the DNS challenge entry you’ve created in the section Option 2: Preparing DNS entry with an external DNS provider.

Pointing your traffic to Azion

Below are steps for pointing your traffic to Azion. There are separate instructions for the legacy Domains settings and the new Workloads product.

If you’re not sure which steps apply to your account, see the Verify Your Account Migration to API v4 guide to determine if your account has already been migrated.

Once you have an active Let’s Encrypt certificate, you can point your traffic to Azion by associating your Azion-provided Workload Domain address xxxxxxxxxx.map.azionedge.net to your domain’s CNAME record. To do so:

  1. Access Azion Console > Workloads.
  2. From the Workloads list, copy the Azion-provided domain address that you want to associate to the external domain, which should be in the format xxxxxxxxxx.map.azionedge.net.
  3. In another browser tab, access your DNS provider.
  4. Navigate to the DNS management area.
  5. Edit the domain CNAME record with the Let’s Encrypt certificate as follows:
NameValueType
www.yourdomain.orgxxxxxxxxxx.map.azionedge.netCNAME
  1. Save your settings.

Note that there might be a delay in propagation time when you access your application. If that’s the case, you can run the DIG command in your terminal to check whether your domain points to the Azion address.