CLOUD PAAS / APPLICATION SETTINGS

Custom SSL

This guide has been reviewed and reformatted for Ruk-Com Cloud PaaS. Screens may vary slightly by platform version.

Click or tap a screenshot to view it at its original size.

Objective

This guide explains how to use Custom SSL on Ruk-Com Cloud PaaS, with ordered procedures and practical verification points.

Before you begin

Sign in with an account permitted to manage the relevant environment.
Confirm the target environment, region and resources before saving changes.
Create a backup or rollback plan before changing a production system.

Support for SSL certificates significantly strengthens the security of your domain name. And with the Ruk-Com Cloud Platform (PaaS), installing and deploying SSL for applications has become simple and flexible.

In addition to Built-in SSL and Let's Encrypt SSL solutions, Ruk-Com Cloud also allows you toUpload and deploy a custom SSL certificate.(Custom SSL) to your environment freely.

?Supported SSL certificate types

Self-signed Certificate
Wildcard Certificate
Multi-Domain (SAN) Certificate
Extended Validation (EV) – Single Domain
Extended Validation (EV) – Multi-Domain
Low Assurance / Domain-Validated (DV) Certificate

In this guide, we'll walk you through how to install and deploy a custom SSL certificate for a single domain on your environment.

Creating and installing a Custom SSL Certificate on Ruk-Com Cloud

To add a custom SSL certificate to your environment on Ruk-Com Cloud, the following elements need to be ready:

Domain name that has already been purchased
server key
intermediate certificate or certificates chain (CA)
domain certificate

⚠️Note:If you buyDomain Name with SSL certificate provided by the service provider.(e.g. GoDaddy, Namecheap, etc.) and the seller has provided a ready-to-use certificate. You canSkip the certificate creation step.and proceed to the next section:
“Customize Environment Topology to support Custom SSL”

Steps to create a Custom SSL Certificate

Please follow these instructions to create an SSL certificate for use with Ruk-Com Cloud:

1. Buy a Domain Name

Choose to buy a domain name (such asmysite.com) from any provider such as GoDaddy, Namecheap, or a provider you trust.

2. Generate Server Key and Certificate Request (CSR).

You need to createPrivate Keyfor your domain and then createCSR (Certificate Signing Request)To send it to the certificate authority (CA), we useOpenSSLIt is an example of a tool in action. (Available on Linux, macOS, and Windows with OpenSSL installed)

For Windows
For Linux/MacOS/FreeBS

How to request a certificate for Windows

DownloadLatest version of OpenSSL (select the 64-bit or 32-bit version depending on your system) installed and select “The OpenSSL binaries (/bin) directory” option for PATH if available. After installation is complete, go to the folder.bin(such asC:\OpenSSL-Win64\bin) andDouble click onopenssl.exeto activate the tool

1. Create a Private SSH Key

The first step of requesting an SSL certificate is to create a Private Key for your server using the command:

genrsa -out {filename} {length}

where:

{length}is the length of the key (Key Length) in bits.
➤Recommend minimumis2048bit for safety
➤Example: 4096Bit for high security

{filename}is the name of the file you want to export, with the extension.key
➤Example: server.key

Note:The passphrase (password) should not be set to the Private Key as it may cause an error when adding the certificate to the Ruk-Com Cloud Dashboard.

2. Create a certificate request (CSR - Certificate Signing Request)

After you have created the Private Key (server.key) and then the next step is to create a certificate request (CSR) to send to the certificate authority (CA). Use the following command in Command Prompt /PowerShell:

req -config {config_path} -new -key {keyname} -out {filename}

where:

{filename}= File name that will be used to store the certificate request (extension.csr)
➤ Example:server.csr

{config_path}= file locationopenssl.cnfIt's in the same folder where OpenSSL is installed.
➤ Example:C:\OpenSSL-Win64\bin\openssl.cnf

{keyname}= Name of Private Key file created
➤ Example:server.key

When running this command The system will ask a series of questions, such as:

Email Address
Country Name (TH)
State or Province Name
Locality Name
Organization Name
Organizational Unit Name
Common Name(⚠️It must match the domain name you purchased, e.g.mysite.com)

Note:Field valueCommon NameMust be the domain name you want to use with SSL (e.g.mysite.com) if filled in incorrectly Your certificate willUnable to verify correctness

How to request a certificate for Linux/MacOS/FreeBSD

If you haven't installed the tool yet,OpenSSLStart by installing it through your system's package manager by opening Terminal and using the following command:
Linux: Ubuntu/Debian

sudo apt-get update
sudo apt-get install openssl

Linux: CentOS
(Nginx on the platform)

sudo yum install openssl

After successfully installing OpenSSL Proceed to create the required files. All files created with OpenSSL will be saved in the directory where you ran the command.

1.Create Server Key (Private Key)

Open Terminal and use the following command to create a Private Key:

openssl genrsa -out {filename} {length}

where:

{length}= Length of the key in bits (at least 2048 bits recommended for security)
➤ Example:4096

{filename}= desired key file name, e.g.server.key

Note:The passphrase should not be set on the Private Key as it may cause problems during upload and use with Ruk-Com Cloud Dashboard.

2.Create a certificate request (CSR)

After you have completed creating your Private Key. The next step is to createCSR (Certificate Signing Request)which is sent to the certificate authority (CA).

Use the following command in Terminal:

openssl req -new -key {keyname} -out {filename}

where:

{filename}is the name of the CSR file that will be created, with the extension.csr
➤ Example:server.csr

{keyname}is the name of the Private Key file you created earlier.
➤ Example:server.key

When running the command You'll be asked for various information to use in the certificate, such as:

Email Address
Country Name (country code e.g.TH)
State or Province Name
Locality Name (city)
Organization Name (name of company/organization)
Organizational Unit Name (e.g. department)
Common Name(⚠️ Specify the domain name, e.g.mysite.com)

⚠️Note:channelCommon NameIt must match the domain name you purchased. If specified incorrectly Your certificate willUnable to verify correctness

3.Send a request (CSR) to the certificate authority (CA).

After you have created the CSR file (server.csr) then send this file toCertificate Authority (CA)that you want to use or the domain provider you purchased from, such as Namecheap, GoDaddy, Sectigo

Tip:If you want to test or use only internally, you canSign the certificate yourself(Self-signed Certificate). Click the link to see how to do it.

4:Wait for inspection and receive the certificate.

The CA provider will specifically verify the information you provide in the CSR:

Accuracy of the domain name (Common Name)
Organization information (If it is an EV certificate)

If the verification is successful, the CA will return to you:

Intermediate Certificate (or Certificate Chain)→ An intermediate certificate that is trusted by web browsers.

Domain Certificate→ Certificate issued for your domain.

Once you have received all these files (e.g.server.crt,intermediate.crt) You can carry out Instantly install and configure certificates in your environment on Ruk-Com Cloud.

Customize Environment Topology to support Custom SSL

To properly and securely use Custom SSL certificates, your environment should meet the following conditions:

There is a settingCustom DomainDone.
is attachedPublic IPwith the server that is the entry point (Entry Point)

Note:If your environment uses.NET, Go, Node.js orcustom Docker containersshould installLoad Balancerthat supports Custom SSL. In this case, the Public IP should be attached to the Load Balancer, not the Application Server directly, so that the Load Balancer acts as an Entry Point for secure data transmission over SSL.

1. Login to Ruk-Com Cloud Dashboard and create a new environment or select the button.Change Environment Topology

2. In the windowEnvironment Topology:

Look for the SSL switch at the top of the frame for each server.
Click Activate. And then check that:wp:list wp:list-item
There is a green checkmark indicating that the conditions for using SSL are complete.
If any item is not passed The system will display a warning sign for you to make corrections.

If the option does not display a green check mark You can take action now by: ✅ Clicking on the button."Enable"next to options that are not yet enabled. The system will automatically make the necessary settings.

Click on the buttonCreateto create the environment or click the buttonApplyto save changes

Set DNS Record of Domain name

After you have successfully set up your environment and enabled SSL. The next step is toConfigure DNS (A Record)so that your domain points toPublic IPof your active Environment

1. Go toRuk-Com Cloud DashboardCheck your environment's Public IP by expanding the Node that is your environment's entry point (such as a Load Balancer or Application Server) in thePublic IP AddressClick on the ? Copy to Clipboard button to copy the IP address.

2. EnterDNS Managerof the Domain Name Provider After copying your Environment's Public IP Address from the Ruk-Com Cloud Dashboard, go to the DNS management system of the provider you used to register your domain, such as: GoDaddy, Namecheap, Cloudflare.
or another service provider you are using

More information and detailed examples can be found inCustom Domain via A Record

Upload the SSL certificate to your environment.

The final step you need to take is to upload the certificate file to your environment.

1. ClickSettingsto set the environment

2. In the open tab, selectCustom SSLin the list on the left hand side
Upload the Server Key, Intermediate Certificate (CA), and Domain Certificate into the fields and press the button.Save

where:

Server Key will be a file with the extension.key.
Intermediate Certificate (CA) จะเป็นไฟล์นามสกุล.crt (ตัวอย่างเช่น intermedia.crt)
The Domain Certificate will be a.crt file (for example: yourdomain_com.crt)

Verify functionality after setting up SSL. Open your web browser and enterDomain namethat you bind to the Environment uses the protocolhttps://insteadhttp://
➤ Example:https://mysite.com

If everything is set up correctly You will be able to access your applications normally and the browser will display a symbol.padlockto confirm thatSecure Connectionthen

Tips:If you want to set up HTTPS Redirection further, you can do so by installingadd-on HTTPS RedirectionIn the add-ons menu