DaaS / Products / Deploy HTTPS Across App and AIRec

Deploy HTTPS Across App and AIRec

A developer enables HTTPS for their entire platform by deploying SSL certificates to general cloud infrastructure (ECS, SLB, CDN) via CAS while also configuring HTTPS specifically for their AIRec recommendation service, ensuring end-to-end encrypted traffic across both the main application and personalized recommendation endpoints.

Products involved

Scenario

Use this workflow when you need to unify TLS encryption across your core application infrastructure and AIRec recommendation endpoints. By centralizing certificate lifecycle in CAS and mapping certificates to AIRec, you ensure consistent HTTPS termination at the edge (SLB/CDN) and secure, encrypted API calls to personalized recommendation services.

Integration steps

  1. Provision Certificate in CAS: Upload or issue your SSL certificate via the CAS console. Ensure the certificate chain and private key are in PEM format.
  2. Deploy to Edge Infrastructure: Attach the certificate to your SLB or CDN using the CAS deployment API:

    3. ``bash aliyun cas DeployCertificateToCloudResource \ --CertificateId "cert-8a9b2c" \ --CloudServiceType "SLB" \ --CloudServiceInstanceId "lb-xyz789" \ --RegionId "cn-hangzhou" ``

  3. Prepare AIRec Mapping File: Download the certificate_info.xlsx template from the AIRec console. Populate domain, certificate_id, and cert_type columns with your CAS certificate details.
  4. Bind Certificate to AIRec: Upload the mapping file and certificate artifacts to your AIRec instance:

    5. ``bash curl -X POST "https://airec.cn-hangzhou.aliyuncs.com/v2/openapi/instances/{InstanceId}/certificates/bind" \ -H "Authorization: Bearer <TOKEN>" \ -F "mapping_file=@certificate_info.xlsx" \ -F "[email protected]" \ -F "key=@private_key.pem" ``

  5. Validate Domain Ownership: AIRec triggers DNS CNAME or HTTP file validation. Monitor progress via GET /v2/openapi/instances/{InstanceId}/certificates/status.
  6. Enforce HTTPS on AIRec: Once validation returns SUCCESS, enable HTTPS enforcement in the AIRec instance settings. Update your recommendation client base URL to https://<custom-domain>.
  7. Verify End-to-End Encryption: Test both the main app and AIRec endpoints:

    8. ``bash openssl s_client -connect <airec-domain>:443 -servername <airec-domain> | grep "Verify return code" ``

Architecture

CAS acts as the centralized certificate orchestrator for general cloud resources, handling TLS termination at SLB/CDN/ECS. AIRec consumes the certificate via certificate_info.xlsx mapping to secure its recommendation API endpoints. Client traffic hits the CAS-managed edge first, routes to your application server, and forwards personalized queries to AIRec over a dedicated HTTPS channel. Both layers operate independently but share the same certificate trust chain.

Prerequisites

Common pitfalls

Typical questions