Serving a certificate

Attach the certificate to an HTTPS listener by CRN, UUID or exact name in your account:

Console
API
CLI
Go

While creating an HTTPS listener, use the TLS certificates card to Select one or more certificates. The first is the default. Existing listeners display certificates read-only; use the API to manage them.

POST /v1/load-balancers/{id}/listeners/{listener_id}/certificates
{ "certificate": "crn:certificate::my-account:certificate/prod-frontend",
  "is_default": true }

basaltic loadbalancer listener attach-certificate <id> <listener-id> \
  --certificate crn:certificate::my-account:certificate/prod-frontend \
  --is-default

l, err := loadbalancer.New(cfg).AttachListenerCertificate(ctx, lbID, listenerID,
    &loadbalancer.AttachListenerCertificateRequest{
        Certificate: "crn:certificate::my-account:certificate/prod-frontend",
        IsDefault:      basaltic.Bool(true),
    })

The CRN is the whole request — no key material travels here.

A listener can hold several certificates and picks one per connection by matching the client’s SNI against each certificate’s SANs. The one identified by default_certificate is the fallback for a client whose SNI matches nothing, or that sends no SNI at all. Setting a new default demotes the previous one in the same transaction.

Detaching a certificate is refused in two cases: removing the last certificate from an HTTPS listener, and removing the current default while other certificates are still attached. Promote a replacement first.

List the certificates with GET /v1/load-balancers/{id}/listeners/{listener_id}/certificates, which returns certificates as ResourceRefs with meta. Attaching returns { "certificate": ResourceRef }. The listener itself carries only default_certificate, not the full collection. To change the default, PATCH the listener with default_certificate set to the UUID, CRN, or name of an already attached certificate. To detach, use the source certificate UUID from certificates[].id in DELETE /v1/load-balancers/{id}/listeners/{listener_id}/certificates/{certificate_id}. See listener certificate management for the complete flow.

Get started

Products

Platform

Help

Serving a certificate

Serving a certificate

​Serving a certificate

Serving a certificate