The new certificate is in Certificate Management Service, but browsers still report an expired certificate. Check the load balancer's HTTPS listener: that is where the certificate presented to visitors is bound. Uploading a new certificate, or replacing the certificate on a backend server, may leave that binding unchanged.
When one certificate serves several listeners, it is easy to miss one listener or an additional domain binding. Here is where to update certificates on CLB and ALB, and how to automate those updates after renewal.
CLB: Check the Default Certificate and Extended Domains
Open the CLB instance's listener list, find the HTTPS listener, and use Manage Certificates to select the new default certificate.
Extended domains have their own certificate bindings. Updating only the default certificate may leave those domains serving the old one.
If several listeners or extended domains reference the same old certificate, Certificate Management → Replace Certificate can update its associated resources together. Check the affected resources before proceeding and schedule the replacement during a quiet period.
For example, a domain might be served by load balancers in both Shanghai and Singapore. Updating the Shanghai listener leaves Singapore unchanged. Check the instance, region, and listener port as well as the domain.
ALB: Update the Binding for the Right Domain
Prepare the certificate in Certificate Management Service, then open the ALB instance's listener list and choose Manage Certificates → Server Certificates. You can replace the default certificate or add an additional certificate there.
Suppose www.example.com uses the default certificate and api.example.net uses an additional certificate. Update the API's binding while preserving the website's certificate. Verify that the new certificate is live before removing the old binding, rather than replacing the listener's entire certificate list.
For listeners managed by Kubernetes ALB Ingress, update certificates through the cluster's configuration.
Automating Renewal and Deployment for Free Certificates
Alibaba Cloud offers hosting for paid certificates, with automatic renewal and deployment. If you already use it, keep doing so. Free personal test certificates last about three months and do not support hosting; you need to request and deploy replacements.
To keep using free certificates without replacing each listener's certificate by hand, you can use LapseZero. It issues and renews certificates through Let's Encrypt, then deploys them to connected targets such as CLB, ALB, CDN, and Nginx. This does not use Alibaba Cloud's free certificate quota or require deployment scripts.
Setup involves three tasks:
- Add your domain and configure the CNAME records shown for DNS delegation. Future renewals reuse those records.
- Connect an Alibaba Cloud RAM user and follow the console guide to grant deployment permissions. DNS write access is not required.
- Select the HTTPS listeners to update and request the first certificate.
Future renewals deploy automatically to those listeners. If the same certificate is used elsewhere, add those targets too. You can also set a deployment window to keep changes outside busy hours.
Verify the Certificate Visitors Receive
After deployment, check the certificate using the site's hostname. If that hostname points to a CDN, you will see the CDN's certificate. To check the load balancer, use a hostname that points directly to it and is covered by the certificate.
Set that hostname as the target's live check address in LapseZero to verify it automatically after each deployment. If the check finds the old certificate still in use, a notification helps you identify the missed endpoint.
Top comments (0)