Preface

Usually, when building a website, an unavoidable step is providing external HTTPS access. If domain resolution and CDN are handled by Cloudflare, it's not so bad (compared to domestic cloud providers, Cloudflare's SSL configuration steps are practically negligible). However, if you are using domestic cloud providers' CDN, SLB, or other technologies, or building a website directly on a cloud host, you must face the issue of applying for SSL certificates. Normally, a personal Tencent Cloud account can apply for up to 50 free certificates (previously 20, upgraded to 50 starting January 17, 2024, where 30 free certificates can be bound to Tencent Cloud domains, and 20 free certificates support binding to any domain on the network, though this requires becoming a Tencent Cloud V2 member), and you can also get 20 free certificates from Alibaba Cloud. Currently, newly applied free certificates from Tencent are still valid for 1 year (which is actually TrustAsia's 1-year certificate), as shown below:

However, Alibaba Cloud's free certificates have been reduced to 3 months starting from November 14, 2023:

Tencent's 1-year free certificates still have value, but Alibaba Cloud's 3-month free certificates are truly pointless. It's better to just use Let's Encrypt with automatic renewal (could it be a direct shift from TrustAsia's 1-year to Let's Encrypt's 3-month?).

Generally speaking, if the origin server uses a Linux panel or NPM (Nginx Proxy Manager), they all support Let's Encrypt's automatic renewal upon expiration, or automatic renewal via nginx + acme.sh scripts. However, the most troublesome part is not the origin server, but rather the custom Let's Encrypt certificates that have already been uploaded to domestic cloud providers, such as the Let's Encrypt certificate I uploaded to Tencent Cloud:

The expiration date is April 6th, which is only a few days away, and it is associated with 12 resources (and that's just 12 for now, who knows how many in the future). I can't possibly regenerate and upload it every 3 months, and then update 12 associated resources—that would exhaust me. In fact, it was precisely because of this issue that I initially tried to use the 1-year free certificates I got from Tencent Cloud as much as possible. As a result, I exhausted my certificate quota during experiments (at that time, there were only 20 free certificates, but even the current 30 wouldn't be enough for me to squander)... In the end, I was forced back to face this problem (to be fair, the 20 1-year certificates back then should have been enough for normal people, but unfortunately, I am not normal).

So now, the only problem to solve is the expiration renewal of Let's Encrypt certificates uploaded to cloud providers and those already deployed to associated resources (CDN, SLB, CLB, etc.). If this problem is solved, then we will truly achieve "SSL certificate freedom" and never have to worry about "SSL certificate expiration" again. Furthermore, it would be even better if we could also solve the renewal of Let's Encrypt certificates deployed in other ways in a one-stop manner. Is there such a way? Yes, there is, and that is the one-stop solution provided by OHTTPS.

OHTTPS

First, let's look at the official introduction of OHTTPS:

Judging from the description in the red box in the image above, it happens to solve my headache (and it indeed does, as verified). In essence, OHTTPS accesses various environments and updates certificates through legitimate access methods (such as API and SSH) provided by these environments (Linux panels, cloud providers, cloud hosts, etc.). Therefore, it involves obtaining APIs for various environments. I will introduce the operation methods for two commonly used environments (Baota Panel and Tencent Cloud CDN) later.

Register an OHTTPS Account

Visit the official OHTTPS website:https://ohttps.com/, and click "Register" in the upper right corner:

Fill in the registration email and password, and click "Register" in the red box below after obtaining the email verification code:

Then proceed to the step of adding a domain name. It is recommended to directly add a wildcard domain. Taking my idle domain tangwudi.xyz as an example, fill in directly:*.tangwudi.xyz, and then click "Next" in the red box at the bottom right:

There are two ways to verify the domain name. One is the "DNS Authorization-Free Mode", which is actually the CNAME method. Add the content in the red box below as a CNAME record in the domain provider's console:

The other is the "DNS Authorization" mode, which directly provides API access to log into the domain provider's console:

The first method is more secure, and the second method is more convenient (if using Cloudflare, the Global API is required). You can choose according to your preference.

Note 1: If you choose the first method, do not delete the CNAME record, otherwise future certificate updates will fail.

Note 2: If you want to use services provided by domestic cloud providers, the domain name must have an ICP filing.

After clicking "Create Certificate" in the red box at the bottom right, proceed to Step 3, Apply for Certificate:

After a successful application, download and save the private key file in the 1st row and the certificate file in the 3rd row respectively, and then click "Manage Certificates" in the red box at the bottom right:

Then officially enter the OHTTPS console:

Note: The certificate and private key files downloaded above are actually the Let's Encrypt certificate and private key files obtained (valid for only 3 months from the creation time). These two files are required when importing custom certificates in other deployment environments (Linux panels, cloud providers, cloud hosts, etc.), so they need to be saved properly.

OHTTPS supports unified deployment and certificate updates for the environments shown in the red box in the image below:

As you can see, in addition to supporting commonly used cloud providers like Alibaba Cloud, Tencent Cloud, Qiniu Cloud, and Baidu Cloud Accelerate, it also supports Baota Panel, Docker, and SSH (corresponding to cloud hosts), making it highly practical and versatile.

Below, I will demonstrate the deployment process using two environments I currently use: Baota Panel and Tencent Cloud.

Deploy OHTTPS Node - Pagoda Panel

Configure Pagoda Panel

Since OHTTPS needs to access the Baota Panel from the public network, for security reasons, it is still necessary to enable Panel SSL. Go to "Panel Settings" - "Security Settings" - "Panel SSL Configuration":

Open the key and certificate files saved in the previous section with a text editor, copy their contents into the key box and certificate box respectively, and then click Save below:

Then go to "Panel Settings" - "API Interface":

Add "119.28.42.104" to the IP whitelist of the Baota Panel API and write down the API key in the red box:

Note: I have enabled the API interface option, but for some reason, there seems to be an issue starting from version 8.0.5. It shows as disabled even though it is enabled. However, if you click the switch, it prompts that it has been turned off—meaning it behaves opposite to the displayed status. I don't get it.

Configure SSL for Pagoda Panel Sites

Under "Website" - "PHP", select the site that needs SSL configuration. Taking the site "test.tangwudi.xyz" as an example, select "Current Certificate" under "SSL". Just like when enabling the panel SSL, paste the contents of the previously saved private key and certificate files into the key box and certificate box respectively, and click "Save and Enable Certificate" in the red box below:

In the future, you can also directly select and deploy from the "Certificate Folder" in the red box on the right:

Note: If the HTTPS port published by the website is not the standard port 443, you need to modify it in the site's configuration file. For example, if my HTTPS port is published on port 55555, the modification is as follows (remember to click Save at the bottom after modifying):

Add Pagoda Panel Site in OHTTPS

After completing the relevant configurations in the Baota Panel in the previous section, you can deploy the Baota node in OHTTPS. Enter the OHTTPS console and click "Deploy Node" - "Add Node":

Select "Baota Panel" in the type, and select "Website SSL":

Just fill in the aaPanel address in the above image truthfully. Note that if it is a non-standard 443 port, you need to specify it in the format of :port after the address; fill in the API interface key recorded in the previous section; fill in the website name truthfully, which is "test.example.com" in this example, and then click "Next" to enter the associated certificate interface and add the associated certificate:

Select the certificate created earlier and select "OK" in the red box at the bottom right:

Select "Create Deployment Node" in the red box at the bottom right:

Then in "Deployment Nodes", you can see that the website node just now has been successfully deployed:

Deploy OHTTPS Node - Tencent Cloud CDN

Note: The prerequisite for using domestic CDNs, including Tencent Cloud, is that the domain name has been ICP filed. The following takes "test.tangwudi.xyz" as an example.

Obtain "SecretId" and "SecretKey"

Just as adding an aaPanel node in the previous section requires an API key, adding a Tencent Cloud CDN node requires "SecretId" and "SecretKey". I won't go into details on how to obtain them here. The official OHTTPS website has a detailed tutorial, and you can get them by following the tutorial. The tutorial address is as follows:https://ohttps.com/docs/cloud/tcloud/ssl。

Upload Custom Certificate to Tencent Cloud

Go to Tencent Cloud's "Console" - "SSL Certificates" - "Upload Certificate":

In the image below, upload the previously saved Let's Encrypt certificate by clicking upload or copying and pasting the certificate and private key content into the red box, and then click "OK" in the bottom-most red box to upload it to Tencent Cloud's "My Certificates":

Then you can see that the certificate just uploaded is already visible in "Upload Certificate":

Configure HTTPS Service and Associate Certificates for Accelerated Domains in Tencent Cloud CDN

Other steps for configuring the accelerated domain name are omitted. Here, only the relevant HTTPS configuration interface is mentioned. Enable the "HTTPS" service in the red box and configure the certificate, as shown in the figure below:

Select the certificate uploaded in the previous section (my idle domain name is not ICP filed and cannot be used here, so I will use my ICP-filed domain name to simulate the interface here), and then select "OK" in the red box below:

Finally, click "Submit All Configurations" in the bottom-most red box:

Note: Don't forget to configure the domain name's CNAME in the domain provider's DNS console to point to Tencent Cloud's acceleration address. If the domain name was originally purchased from Tencent Cloud, it is simple, just click "One-click Deployment" CNAME, as shown below:

Add Tencent Cloud CDN Node in OHTTPS

Similar to adding the aaPanel node earlier:

Select "Tencent Cloud" and "CDN" in the type, then fill in the relevant information as annotated in the figure below, and then click "Next" in the red box at the bottom right:

The subsequent steps are the same as adding the aaPanel node earlier:


Then in "Deployment Nodes", you can see that the Tencent Cloud CDN node just now has been successfully deployed:

I won't go into detail about how to add other environment nodes, as they are all similar. You can also refer to the official related tutorials.

Configure Automatic Update Time Before Certificate Expiration

On the "Certificate Management" interface of the OHTTPS console, you can set parameters for the certificate's "Automatic notification time before expiration", "Automatic renewal time before expiration", and whether to automatically deploy. Directly on the "Certificate Management" interface, select "Configure" in the rightmost red box of the certificate whose parameters need to be modified:

In the configuration interface, you can directly modify the notification time before certificate expiration, automatic renewal before certificate expiration, and whether to automatically deploy after certificate renewal (this automatic deployment after renewal should refer to the CDN environment, because the CDN environment has a separate SSL certificate option, while aaPanel only has two options: Website SSL and Panel SSL, so presumably only these two can be updated). Nodes that need unified deployment can be directly added to the red box on the right. After completing all configurations, click "Confirm Changes" in the bottom-most red box:

Usage Fees

OHTTPS is not free. The official pricing description is as follows:

Calculated based on one node being updated 6 times a year by default (90-day validity, renewed with 30 days remaining, which means renewed once every 60 days), it costs 25 ✖️ 6 ÷ 100 = 1.5 RMB. If calculated for 20 nodes, it would be 30 RMB. Meanwhile, the price of applying for the cheapest personal wildcard certificate on Tencent Cloud is:

There is still a bit of a gap between 30 RMB and 1385 RMB, and most people probably don't have as many as 20 nodes... How many nodes do I have now?

32 nodes. If calculated as 40 (which I will increase), it's 1.5 ✖️ 40 = 60 RMB a year, which is also acceptable.

Afterword

Actually, Tencent Cloud's quota of 50 free certificates (30 single-domain certificates if the domain name is on Tencent Cloud, and only V2 members get 20 full single-domain certificates) is quite generous. My ICP-filed domain name is on Tencent Cloud's DNSpod, so I currently have 30 1-year free domain certificates. Honestly, with proper planning, it is actually enough for most people. However, if you want to do testing or often have novel ideas, these 30 might not be enough. The worry is that if these 30 certificates are heavily used and imported in multiple locations, replacing them once a year is both troublesome and not troublesome. So I think this is where OHTTPS's advantage lies: it achieves one-stop management and renewal of certificates in all locations at a very low price. For example, for me now, I use certificates for sites on the aaPanel at home acting as the main egress reverse proxy for my home data center, certificates for sites on the aaPanel acting as a reverse proxy on Tencent Cloud Lighthouse instances, as well as the unified renewal of Tencent Cloud SSL certificates and CDN domain name certificates, which is why I have as many as 32...

Actually, there is another issue. The 1-year free single-domain certificates applied for domains on Tencent Cloud DNSpod and the certificates automatically applied for using Let's Encrypt with DNSpod for DNS authentication are both TrustAsia-scoped certificates, so they share the limit of 20 hostnames under a single main domain name:

This led to a very embarrassing problem for me: when my quota of 20 free 1-year certificates on Tencent Cloud was used up, the sites on my aaPanel could no longer apply for certificates using Let's Encrypt either, because the quota of 20 free certificates had been exhausted. In fact, even if Tencent Cloud has 30 free certificates now, it is useless, because of TrustAsia's limit of a maximum of 20 free certificates per main domain name. The extra 10 free certificate quotas can only be used on other main domains on Tencent Cloud (if any).

But OHTTPS can solve this problem, because OHTTPS applies for R3 certificates directly from Let's Encrypt (R3 is one of the intermediate certificates in the Let's Encrypt certificate chain, used to verify the trustworthiness of server certificates), so it is not subject to TrustAsia's limit of 20 certificates per main domain:

In fact, the limit of OHTTPS is just the limit of Let's Encrypt.

In short, Tencent Cloud's 1-year single-domain free certificates are still very attractive. If the number of sites is small, there are not many deployment locations, and management costs are not high, 30 free certificates are enough. As for scenarios with a large number of multi-sites and multi-location deployments, OHTTPS can play its role.

Note 1: Recently, I optimized the deployment nodes on OHTTPS and deleted all those related to aaPanel, because the sites on my aaPanel are all used as origin hosts for Tencent Cloud CDN, and Tencent Cloud CDN does not check the validity of the origin certificate when using HTTPS for origin-pull. So taking advantage of this, I replaced all the SSL certificates of the sites on aaPanel with 15-year certificates (directly using Cloudflare's self-signed 15-year certificates; of course, you can also issue longer ones yourself), once and for all, saving dozens of RMB in OHTTPS automatic renewal fees per year...
Note 2: I was stupid before, adding so many Tencent CDN deployment nodes, when clearly all the domain names on Tencent CDN just needed to point to the same wildcard certificate, and then only that certificate needed to be updated...