tencent cloud

Tencent Cloud EdgeOne

DocumentationTencent Cloud EdgeOneWebsite AccelerationHTTPS CertificateRelated ReferencesCertificate Format Requirements

Certificate Format Requirements

Download
Focus Mode
Font Size
Last updated: 2026-10-13 15:00:51
If your certificate is issued by a root CA, you will receive a unique certificate. No additional certificates are needed, and the configured website will be considered trustworthy by accessing devices such as browsers.
If your certificate is issued by an intermediate CA, you will receive a file containing multiple certificates. You need to manually concatenate the intermediate certificate and the root certificate in the correct order before uploading. The concatenation rule is: put the intermediate certificate first and the root certificate second, with no blank lines in between.
Note:
In general, there will be corresponding instructions issued by the institution when the certificate is awarded. Please refer to the instructions.

Examples of CA certificate format and certificate chain format

Below are examples of certificate and certificate chain formats. Please confirm that the formats are correct before the uploading:
1. Certificates issued by a root CA institution, in PEM format, are as follows:
-----BEGIN CERTIFICATE-----
MIIFsjCCA5qgAwIBAgIUcmZICtONCt8O1gxPTBqwmKwKEpgwDQYJKoZIhvcNAQEL
BQAwcTELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARDaXR5
MRQwEgYDVQQKDAtFeGFtcGxlIE9yZzETMBEGA1UECwwKRXhhbXBsZSBDQTEYMBYG
A1UEAwwPRXhhbXBsZSBSb290IENBMB4XDTI1MTIwNTA5MzUxOVoXDTM1MTIwMzA5
MzUxOVowcTELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVN0YXRlMQ0wCwYDVQQHDARD
aXR5MRQwEgYDVQQKDAtFeGFtcGxlIE9yZzETMBEGA1UECwwKRXhhbXBsZSBDQTEY
MBYGA1UEAwwPRXhhbXBsZSBSb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
MIICCgKCAgEAkMgJTBa8xMs7GTMO2/r3VidkdIBwLZRY0uwEwMafGHLIFy+u70ur
z5icrhXzsDyL/q3WacGJJU3dtRdvsbkTRTFeVMe9SfuPF1kuo8HRqaC0sWUSV+ZM
bULtl/B0IjE7QWXdJAJt8ucITYI/Etmox1lbwzcXqB+agjRUwVgoMxNySbOF4Ww1
Vbiz4OY0BqEf57OWtSxFPnZcnnQwqozMtdbNHDNSyrFhqlqNqeI8HXDtonGb7U8r
AV1PPHuHjdgUW69vJbAZcOm1kmAvmEd+jmAKwcz04E5E/lWPeXHYu+5TpqIynPN/
Khi9jCTzHdCn33/QcSADQ1NVXZn6BN5X73nF1CHNc0AltLR9qJt5lTozuS2WrIas
GYGeVd2gWGC0QkHqy5QVCcm6W44ftTQmVoKGB91/KogG/FQOAFX5NZT++LjvfRcQ
Y2MpHdCSt0OJyNPSPmA3cNSctqeWj4Wwj9vaBNqbcjhxK8Zm2sKTowYx+2bH8zLU
huC6FayRoRi2iu0zIWBNSANpKJkRagQOFxefC+iJs6LcEsaZThcJ0gPyxvWBrCZZ
364kiW6CavDYnP9QZTLR9IMDC32DsMyKSL395vHdctSxS7O9P4/2qoFV7S1wflGI
NYfIlPanWPe5juC/xhks/wk7/C7udtqVylMUY2T4E5Fc8HIWq7uw7GUCAwEAAaNC
MEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFDNH
Eptd5XINi60r9JIP7xmoheC6MA0GCSqGSIb3DQEBCwUAA4ICAQAEQVS709aVxsCd
3JYKXrKra7/aw2Orb6P8iU3EprCEfKrO55iLyPjwW/V3x1YGYv6pD7UZ6jBeAYVZ
ZyC0LBLYnYP4qGs3GZYEXPAdTV9cBXRDMW4SLyeXlTqlhY6Kl4OV3rt9DkrRwMTE
28gwwb1LhcY8C60+cmjymozkRjvgMrdPjaz+ZyTuUc6kXdk4xCvDhkX1n88yKL9O
NWno4+MFIR646bbFzMO9eEDBtosHXGJjPNSYs0TPSbRoUE8pIPau1THWnrB6FQR0
8EJM1Csn6Gk4i+5Hzf+SErRx0k6DQQeuo3zDpQH2+KQHowpAaue/R9Et/H2IwJS2
EnG9Xx82AQC1G2pAZPp4a54S/jESXoN1uEKrF1cx9ornep1fqUTnTBpQxi+XzBSY
3arh1JTTjrwYIHlR/1RUiVwgsmBCcuwuC6EQ9DkHs5iue5hr9NlCteYUrJ3nudyu
aJw8pIOuDs+lpE7AoAtt5eDUWa3x9BSsEBBonruwLV3lrk+kYog/v+jW9+VKb/5d
3O5/6pGbh2guFTm4EqxrbBQX58QbcdTL6r/DH0eyRwyGwUtuygo+N5inHlpRzUeF
+pRV+9/lyT7cc1ASNDH1N/NbIiHWF3y89nT6cv3I7YX5F+gKiLcvUPMO7pRumI1/
gaQfVoJlzdPqxBu6jFpXnFxb2078ag==
-----END CERTIFICATE-----

The certificate format is:
-----BEGIN CERTIFICATE-----,-----END CERTIFICATE----- at the beginning and end.
Each line contains 64 characters, with the last line containing no more than 64 characters.
2. If the certificate is issued by an intermediate institution, the CA certificate must include a multi-level certificate chain. The certificate chain structure is shown as follows:
-----BEGIN CERTIFICATE-----
CA Intermediate certificate authority
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
CA Root certificate authority
-----END CERTIFICATE-----
Certificate chain rules:
There should be no blank lines between the certificates.
All certificates should meet the certificate format requirements mentioned above.

Certificate conversion to PEM format instructions

Generally, HTTPS certificates use the PEM format. For certificates in other formats that need to be converted to PEM, it is recommended to use the OpenSSL tool for conversion. Below are methods to convert several popular certificate formats to PEM.
DER to PEM
P7B to PEM
PFX to PEM
CER/CRT to PEM
The DER format is commonly found in the Java platform.
Certificate conversion:
openssl x509 -inform der -in certificate.cer -out certificate.pem
Private key conversion:
openssl rsa -inform DER -outform PEM -in privatekey.der -out privatekey.pem
The P7B format is commonly found in Windows Server and tomcat.
Certificate conversion:
openssl pkcs7 -print_certs -in incertificat.p7b -out outcertificate.cer
Obtain the content between -----EGIN CERTIFICATE----- and -----END CERTIFICATE----- in outcertificat.cer and upload it as the certificate.
Private key conversion: Private keys can usually be exported in the IIS server.
The PFX format is commonly found in Windows Server.
Certificate conversion:
openssl pkcs12 -in certname.pfx -nokeys -out cert.pem
Private key conversion:
openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes
```
You can convert certificates in CER/CRT formats to PEM by directly modifying their file extensions. For example, you can directly rename the "servertest.crt" certificate file to "servertest.pem".



Previous Topic: Using OpenSSL to Generate Self-Signed CertificatesNext Topic: The Difference Between one-way authentication and Mutual authentication

Help and Support

Was this page helpful?

Help us improve! Rate your documentation experience in 5 mins.

Feedback

Search
    Enter keywords to search documentation