This article explains how to enable and manage SSL certificates in JPaaS, including the difference between Built-in SSL and Custom SSL.

Overview

JPaaS provides more than one way to secure your application with HTTPS:

1. Built-in SSL Certificate
   A quick SSL option that can be enabled directly from the environment settings.
2. Custom SSL Certificate
   A certificate issued for your own domain name and uploaded manually to the environment.

SSL allows your website or application to work securely through:

https://

instead of:

http://

Built-in SSL Certificate

The Built-in SSL option is suitable when you want to quickly enable HTTPS for the default environment URL provided by the JPaaS platform.

It is useful for testing, staging environments, or applications that do not yet require a custom domain.

When to use Built-in SSL

Use Built-in SSL if:

• You are using the default environment URL.
• You want to enable HTTPS quickly.
• You do not have a custom domain connected to the environment.
• You do not want to upload SSL files manually.

Example of a default environment URL:

environment-name.yourdomain.ly

Built-in SSL is generally used only for the default environment domain. It is not the usual option for securing a custom domain such as:

example.com

or:

www.example.com

Built-in SSL may also not be compatible with environments that use a dedicated Public IP for SSL configuration.

How to Enable Built-in SSL

1. Log in to your JPaaS dashboard.
2. Open the required environment, or create a new one.
3. Click Change Environment Topology or edit the environment topology.
4. Go to the SSL section.
5. Enable Built-in SSL.
6. Click Apply if you are editing an existing environment, or Create if you are creating a new environment.
7. After the changes are applied, open your environment URL using:

https://

Custom SSL Certificate

Use Custom SSL when you want to secure your own domain name, such as:

example.com
www.example.com

With Custom SSL, you need to obtain an SSL certificate from a certificate provider and upload the certificate files to your JPaaS environment.

Custom SSL is usually the recommended option for production websites and applications using a custom domain.

Requirements for Custom SSL

Before configuring Custom SSL, make sure you have:

• A custom domain name.
• An SSL certificate issued for that domain.
• The private key, also known as the Private Key or Server Key.
• The domain certificate.
• The intermediate certificate or CA Bundle.
• DNS records pointing the domain to the environment.
• A Public IP is assigned to the correct entry point of the environment.

In some environments, such as Node.js, Go, .NET, or custom containers, the SSL certificate may need to be installed on the Load Balancer if it is the main entry point.

SSL Certificate Files

A Custom SSL setup usually requires the following files.

1. Server Key

This is the private key used to generate the CSR.

Example filename:

server.key

2. CSR

The Certificate Signing Request is sent to the SSL provider to issue the certificate.

Example filename:

server.csr

3. Domain Certificate

This is the SSL certificate issued for your domain.

Example filename:

certificate.crt

4. Intermediate Certificate / CA Bundle

This file contains the intermediate certificates required to complete the SSL trust chain.

Example filename:

ca_bundle.crt

Generate a Private Key and CSR Using OpenSSL

You can generate the private key and CSR using OpenSSL.

Generate the Private Key

openssl genrsa -out server.key 4096

A key size of at least 2048 bits is recommended. You may use 4096 bits for stronger encryption.

Do not protect the private key with a passphrase, as this may cause issues when uploading it to the JPaaS dashboard.

Generate the CSR

openssl req -new -key server.key -out server.csr

During CSR generation, you will be asked to enter certificate details. The most important field is:

Common Name

The Common Name must match the domain you want to secure.

Example:

example.com

or:

www.example.com

For a Wildcard certificate, it may look like:

*.example.com

Point the Domain to the Environment

Before testing Custom SSL, the domain must point to the environment’s public IP.

Steps

1. Log in to your JPaaS dashboard.
2. Open the required environment.
3. Identify the environment entry point. This may be:
   • Application Server
   • Load Balancer
4. Copy the assigned Public IP.
5. Go to your domain DNS management panel.
6. Add or update the required A records.

Example:

Type	Name	Value
A	@	Public IP
A	www	Public IP

DNS changes may take some time to propagate, depending on the DNS provider and TTL value.

How to Upload a Custom SSL Certificate

After preparing the SSL files and pointing the domain to the environment, you can upload the certificate.

Steps

1. Log in to your JPaaS dashboard.
2. Open the required environment.
3. Click Settings.
4. From the left-side menu, select Custom SSL.
5. Paste or upload the required certificate content into the correct fields:
   • Server Key
   • Domain Certificate
   • Intermediate Certificate / CA Bundle
6. Click Save.
7. Some environment components may restart automatically to apply the SSL configuration.
8. Open your domain in the browser using:

https://example.com

Make sure the website loads without SSL warnings.

Built-in SSL vs Custom SSL

Comparison	Built-in SSL	Custom SSL
Best for	Default environment URL	Custom domain
Setup speed	Very fast	Requires SSL files and DNS setup
Requires purchasing or issuing a certificate	No, in most cases	Yes, unless using a trusted free certificate
Requires Private Key	No	Yes
Requires CA Bundle	No	Yes
Suitable for production	Depends on use case	Recommended for custom-domain production sites
Requires Public IP	Usually no	Usually yes
Suitable for www.example.com	No	Yes

Which Option Should I Choose?

Choose Built-in SSL if:

• You are using the default environment URL.
• You need HTTPS for testing or temporary use.
• You do not have a custom domain.
• You want a quick SSL setup without uploading certificate files.

Choose Custom SSL if:

• You are using your own domain.
• The website or application is public and production-ready.
• You already have an SSL certificate issued for the domain.
• You need a Wildcard or Multi-Domain certificate.
• You want visitors to access the application using your own HTTPS domain.

Common Issues and Solutions

1. The website does not work over HTTPS after enabling SSL

Check the following:

• SSL changes were applied successfully in JPaaS.
• All required certificate files were uploaded.
• The domain points to the correct Public IP.
• DNS propagation has completed.
• You are opening the website using https://.

2. Certificate mismatch warning appears

This usually means the certificate does not match the domain being accessed.

Example:

The certificate was issued for:

example.com

but the website is opened using:

www.example.com

In this case, the SSL certificate must include both names, or you should use a Wildcard or Multi-Domain certificate.

3. Error when uploading the Server Key

This may happen if the private key is protected with a passphrase.

Use a private key without a passphrase when uploading it to JPaaS.

4. Browser says the certificate is not trusted

Check that the Intermediate Certificate / CA Bundle was uploaded correctly.

If the CA Bundle is missing or incorrect, some browsers or devices may show SSL warnings.

5. The domain still opens on HTTP only

Enabling SSL makes HTTPS available, but it may not automatically redirect HTTP traffic to HTTPS.

You may need to configure an HTTP-to-HTTPS redirect inside your application, web server, or Load Balancer.

Important Notes

• Keep a secure backup of the Private Key.
• Do not share the Private Key with unauthorized parties.
• When renewing an SSL certificate, upload the renewed certificate to JPaaS before the old certificate expires.
• If your environment uses a Load Balancer, make sure SSL is configured on the correct entry point.
• DNS changes may not take effect immediately because of propagation time.