> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure a third-party TLS certificate

Upsun Cloud automatically provides standard Transport Layer Security (TLS) certificates for all sites and environments.
These certificates are issued at no charge by [Let's Encrypt](https://letsencrypt.org/) and cover most needs.
To use them, you need to [specify HTTPS routes](https://developer.upsun.com/docs/routes/https.md#enable-https).
Note that some [limitations](https://developer.upsun.com/docs/routes/https.md#lets-encrypt-limitations) apply.

Upsun Cloud allows you to use third-party TLS certificates free of charge.

You can use many kinds of custom certificates, including domain-validated, extended validation, high-assurance, or wildcard certificates.
Consult your TLS issuer for pricing and instructions on how to generate a TLS certificate.

Seven days before a third-party custom certificate is due to expire,
Upsun Cloud replaces it with a new default Let’s Encrypt certificate.
This helps prevent downtime.
To avoid switching to a default certificate,
make sure you replace your custom certificate with an updated one
more than seven days before its expiration date.

Note that custom certificates aren't necessary for preview environments as we provision Let's Encrypt certificates by default for them.

### Add a custom certificate

You can add a custom certificate using the [CLI](https://developer.upsun.com/cli.md) or in the [Console](https://developer.upsun.com/docs/administration/web).

Your certificate has to be in PKCS #1 format and start with `-----BEGIN RSA PRIVATE KEY-----`.
If it doesn't start that way, [change the format](#change-the-private-key-format).

To add your custom certificate, follow these steps:

> [tab] Using the CLI
>
> 1. Run the following command:
>
>    ```bash theme={null}
>    upsun domain:add <YOUR_DOMAIN> --cert <PATH_TO_CERTIFICATE_FILE> --key <PATH_TO_PRIVATE_KEY_FILE>
>    ```
>
>    For example:
>
>    ```bash theme={null}
>    upsun domain:add secure.example.com --cert /etc/TLS/private/secure-example-com.crt --key /etc/TLS/private/secure-example-com.key
>    ```
>
>    You can optionally include intermediate SSL certificates by adding `--chain <PATH_TO_FILE>` for each one.
>
> 2. Redeploy your production environment with the following command:
>
>    ```bash theme={null}
>    upsun environment:redeploy
>    ```

> [tab] In the Console
>
> 1. Open the project where you want to add a certificate.
> 2. Click  **Settings**.
> 3. Click **Certificates**.
> 4. Click **+ Add**.
> 5. Fill in your private key, public key certificate, and (optionally) intermediate SSL certificates.
> 6. Click **Add Certificate**.
> 7. Access your production environment.
> 8. Click  **More**.
> 9. Click **Redeploy**.

### Change the private key format

The expected format for your certificate’s private key is PKCS #1.
Private keys in PKCS #1 format start with `-----BEGIN RSA PRIVATE KEY-----`.
If your private key starts with `-----BEGIN PRIVATE KEY-----`, it’s in PKCS #8 format, which isn’t appropriate.

To convert your private key (`private.key`) from PKCS #8 to PKCS #1 format (`private.rsa.key`), run the following command:

```bash theme={null}
openTLS rsa -in private.key -out private.rsa.key
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.