How to Install an SSL Certificate on IBM Cloud

This tutorial explains how to install an SSL certificate on IBM Cloud. IBM Cloud has two infrastructure types, and each handles certificates differently: VPC (Virtual Private Cloud) stores the certificate in Secrets Manager and attaches it to a load balancer, while Classic infrastructure keeps its own SSL certificate store. You will also learn how to generate a CSR for IBM Cloud.

Generate a CSR for IBM Cloud

If you have already generated the CSR and received your certificate from the Certificate Authority, skip the first step and go straight to the section for your infrastructure type.

A CSR (Certificate Signing Request) is a block of encoded text that carries your contact and domain information. To get an SSL certificate, you create the CSR and send it to your Certificate Authority for validation. Generating the CSR also produces your private key, which you will need during installation. IBM Cloud has no console form that creates a CSR or a key for an imported certificate, so you generate both yourself.

You have two options:

• Use our CSR Generator to create the CSR and private key automatically. You only enter your details, and the tool builds both for you.
• Generate the CSR with the OpenSSL command line on your own machine.

To build the CSR and a 2048-bit key with OpenSSL, run:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Submit the CSR to the Certificate Authority during your order. Keep the private key in a safe place and do not share it. Do not lose or delete it: without the matching key, the issued certificate cannot be installed.

Note: the -nodes flag leaves the key unencrypted, which is what IBM Cloud requires (Secrets Manager and the Classic store both reject passphrase-protected keys). Do not add a challenge phrase to the CSR.

Install an SSL certificate on IBM Cloud VPC (Secrets Manager)

This is the current method for VPC workloads: Application Load Balancers, Kubernetes Ingress through an ALB, and modern deployments. The certificate is stored in Secrets Manager and the load balancer reads it from there, so the steps are import the certificate, authorize the load balancer, then select the certificate on an HTTPS listener.

About Certificate Manager: older IBM Cloud guides referenced a service called Certificate Manager. IBM retired it (End of Support was 31 December 2022) and moved certificate storage into Secrets Manager. If you still have certificates in a legacy Certificate Manager instance, migrate them to Secrets Manager. For new installations, use Secrets Manager directly as shown below.

You need a Secrets Manager instance before you start. If you do not have one, create it from the IBM Cloud catalog (the Trial or Standard plan both work), then return here.

Step 1: Prepare your certificate files

After validation, the Certificate Authority sends you a ZIP archive. Extract it. You should have three things in PEM format:

• yourdomain.crt, your server (leaf) certificate.
• intermediate.crt or yourdomain.ca-bundle, the intermediate certificate(s).
• yourdomain.key, the unencrypted private key you created with the CSR.

If your key is passphrase-protected, remove the passphrase first, because Secrets Manager only accepts an unencrypted key:

openssl rsa -in yourdomain.key -out yourdomain_nopass.key

Step 2: Import the certificate into Secrets Manager

• In the IBM Cloud console, open the navigation menu and go to Resource list.
• Expand Security and select your Secrets Manager instance.
• In the Secrets table, click Add.
• On the first page, choose TLS certificate. On the next page, choose Import certificate.
• Give the secret a Name (no spaces), then upload your files: the server certificate in the Certificate field (required), the Private key field (required for a working HTTPS listener), and the Intermediate (ICA) field (recommended so the chain is complete).
• Click Create to save the certificate.

Note: secret names cannot contain spaces, and a name that begins with an asterisk is rewritten to star. The private key must match the certificate, and both must be unencrypted PEM.

Step 3: Authorize the load balancer to read Secrets Manager

Before a VPC load balancer can use the certificate, you grant it access with a service-to-service authorization in IAM. You only do this once per account.

• Go to Manage > Access (IAM) > Authorizations and click Create.
• Source service: VPC Infrastructure Services. Narrow the Resource type to Load Balancer for VPC.
• Target service: Secrets Manager (scope it to the instance that holds your certificate).
• Service access role: Writer.
• Click Authorize to save it.

Step 4: Attach the certificate to an HTTPS listener

• Open your Application Load Balancer from the IBM Cloud console (under VPC Infrastructure > Load balancers).
• Add a new HTTPS listener on port 443, or edit an existing one.
• For the SSL certificate, select your certificate from Secrets Manager, or paste the certificate’s CRN (Cloud Resource Name).
• Click Save to apply the listener.

Your load balancer now serves HTTPS using the certificate stored in Secrets Manager. To confirm the result, use our SSL Checker or open the site in a browser and check the padlock.

On renewal: when you replace the certificate in Secrets Manager, the change is not always picked up by the listener automatically. If the old certificate is still served, edit the listener (for example, reselect the certificate or adjust the pool) to force the load balancer to reload it.

Install an SSL certificate on IBM Cloud (Classic Infrastructure)

Use this section only if you run Classic infrastructure (Classic load balancers or other Classic services). It does not apply to VPC or to Application Load Balancers. You can import the certificate from the console or from the CLI, then assign it to a Classic load balancer listener.

Option A: Import from the console

• In the IBM Cloud console, open the navigation menu and go to Security > SSL > Certificates.
• Click Import SSL certificate and fill in the fields:

• Certificate: the contents of yourdomain.crt.
• Private Key: the contents of yourdomain.key (unencrypted).
• Intermediate Certificate: the contents of intermediate.crt.
• Click Add. The certificate stays in the SSL certificates list until you remove it, and you can assign it to any Classic service that needs SSL.

Option B: Import from the IBM Cloud CLI

If you prefer the command line, upload the certificate, private key, and intermediate chain in one command with the Classic infrastructure plugin:

ibmcloud sl security cert-add --crt server.crt --key server.key --icc intermediate.crt

Confirm the upload by listing the certificates in the Classic store:

ibmcloud sl security cert-list

The command returns each certificate with an id and its common name. Note the id of the one you just added; you will use it when assigning the certificate.

Assign the certificate to a Classic load balancer

• Open the IBM Cloud console and go to Classic Infrastructure in the navigation menu.
• Go to Network > Load Balancers and select the load balancer you want to configure (Local or Global, depending on your setup).
• Open the Listeners tab. If there is no HTTPS listener, add one.
• In the HTTPS listener’s SSL settings, choose your uploaded certificate from the dropdown, then save.

Your Classic load balancer now terminates TLS with the certificate you imported. Verify it with our SSL Checker.

Frequently Asked Questions