Introduction
This document primarily describes how to configure a user-owned domain name (a custom domain name, such as example.com) to access Cloud Object Storage (COS) resources over HTTPS. The detailed operational instructions are as follows:
Operation Steps
Configuring HTTPS Access When CDN Acceleration Is Enabled
Step 1: Binding a Custom Domain Name
Bind your own domain name to a bucket, enable CDN acceleration, and then access COS resources over HTTPS via your own domain name. For detailed instructions, see the Enable Custom CDN Acceleration Domain Name document. Step 2: Configuring HTTPS Access
Configuring HTTPS Access When CDN Acceleration Is Disabled
This section uses an example to describe how to access a bucket located in Guangzhou with the name testhttps-1250000000 directly via your own domain name https://example.com without enabling CDN acceleration. The detailed steps are as follows:
Step 1: Binding a Custom Domain Name
You can bind your own domain name to a bucket and then bind a certificate to your domain name in the COS console to access COS resources over HTTPS. For details, see Method 1. You can also achieve HTTPS access by configuring a custom domain name via reverse proxy (with CDN acceleration disabled). For details, refer to Method 2. Method 1: Bind a custom origin domain name via the COS console.
Bind the domain name https://example.com to the bucket testhttps-1250000000 and bind a certificate. For detailed instructions, see the Enable Custom Origin Domain Name document. Method 2: Configure a reverse proxy for a domain name.
Configure a reverse proxy for the domain name https://example.com on your server. Refer to the following configuration for details (the following Nginx configuration is for reference only):
server {
listen 443;
server_name example.com ;
ssl on;
ssl_certificate /usr/local/nginx/conf/server.crt;
ssl_certificate_key /usr/local/nginx/conf/server.key;
error_log logs/example.com.error_log;
access_log logs/example.com.access_log;
location / {
root /data/www/;
proxy_pass http://testhttps-1250000000.cos.ap-guangzhou.myqcloud.com;
}
}
Here, server.crt; and server.key are the HTTPS certificates for your own (custom) domain name. If your domain name does not have an HTTPS certificate, go to the Tencent Cloud SSL Certificates page to apply for one.
If you do not have a certificate for now, you can delete the following configuration information. However, an alarm will appear when you access the site. You can click Continue to proceed with the access. ssl on;
ssl_certificate /usr/local/nginx/conf/server.crt;
ssl_certificate_key /usr/local/nginx/conf/server.key;
Step 2: Resolving the Domain Name to the Server
Resolve your domain name at your domain's DNS resolution service provider. If you use Tencent Cloud DNS resolution, go to the DNS Resolution Console and resolve the domain name example.com to the server IP address from Step 1. For detailed instructions, see Quickly Add Domain Name Resolution. Step 3: Advanced Configuration
Open a web page directly in a browser
After you configure a custom domain name to support HTTPS access, you can download objects in a Bucket via your domain name. If you need to directly access web pages, images, and other resources in a browser based on business requirements, you can use the static website feature. For detailed instructions, see Set Static Website.
After the configuration is complete, add a line of information to the Nginx configuration, restart Nginx, and refresh the browser cache. proxy_set_header Host $http_host;
Replace $http_host with the default access domain name of your bucket, for example, proxy_set_header Host testhttps-1250000000.cos.ap-guangzhou.myqcloud.com.
Configure Hotlink Protection
If a Bucket is public, it is at risk of being hotlinked. You can prevent malicious hotlinking by configuring hotlink protection and enabling the Referer allowlist. The specific steps are as follows:
2. In the Nginx configuration file, add a line of information, restart Nginx, and refresh the browser cache.
proxy_set_header Referer www.test.com;
3. After the configuration is complete, if you open the file directly, an error errorcode: -46616 will be reported. The error message indicates that the request did not hit the referer allowlist. However, you can access the custom domain name via a proxy to open the web page normally.
{
errorcode: -46616,
errormsg: "not hit white referer, retcode:-46616"
}