Managed Load Balancer SSL Certificates

Managed Load Balancer service includes a built-in SSL certificate management system that enables users to dynamically obtain certificates or manually upload existing ones. Including an SSL certificate bundle to a Load Balancer frontend allows users to enable a secure connection via HTTPS.

These features are available at the UpCloud Control Panel as well as via the UpCloud API.

Using a bundle on several load balancers

You can attach the same certificate bundle to frontends on several load balancers, including load balancers in different locations. When the bundle's certificate is updated or renewed, every load balancer that uses the bundle serves the new certificate.

Manual

The Manual mode lets users import existing SSL certificate bundles.

Users are able to upload their SSL certificate, any included intermediaries, and the corresponding private key to create certificate bundles. These are usually obtained together via the service used to generate and authenticate the certificates.

Dynamic

The Dynamic mode sets a request to generate a new SSL certificate when attached to a Load Balancer frontend.

Creating a dynamic SSL certificate bundle allows users to obtain certificates directly to their Load Balancer by creating the necessary DNS records to demonstrate their authority over the claimed domain names.

The DNS record depends on the hostname:

• Hostname, such as app.example.com: point the hostname at the load balancer with a CNAME record to its DNS name, which looks like lb-<id>-1.upcloudlb.com. The certificate authority then checks the hostname through the load balancer.
• Wildcard, such as *.example.com: create a CNAME record for _acme-challenge.example.com that points to your account's challenge domain. To get the challenge domain, call GET /1.3/load-balancer/certificate-bundles/dns-challenge-domain. You can create this record before the load balancer exists.

Validation starts when you attach the bundle to a frontend, so create the DNS record first. A certificate for a hostname is usually issued within a minute, and a wildcard certificate within a few minutes. If validation fails, the bundle's state is failed-challenge. Correct the DNS record, then save the bundle again with the same hostnames to restart validation, for example with PATCH /1.3/load-balancer/certificate-bundles/{uuid} and the same hostnames list.

Dynamic certificates are issued by ZeroSSL, whose certificates are signed by Sectigo. If a domain has CAA records, they must allow sectigo.com. Domains without CAA records need no changes. See CAA records for automatically issued certificates for details.