In sets, you define shared settings that act as an infrastructure standard for the entire collection. While every service hostname in the set inherits these settings automatically, you can opt out from the shared scheme and apply unique configurations for hostnames that need it.

Secure network

To secure content over HTTPS, Akamai offers two distinct security levels: Standard TLS and Enhanced TLS.

🚧

This setting is locked once you create a workspace. All service hostname sets automatically inherit this fixed configuration.

Standard TLS

Standard TLS uses a Level 1 (L1) certificate for secure HTTPS delivery. It is SOX and ISO compliant, but doesn't meet PCI or FedRAMP standards. Use it for general web traffic, public sites, and content that doesn't exchange Personally Identifiable Information (PII).

Standard TLS uses the edgesuite.net suffix for edge hostnames.

Enhanced TLS

Enhanced TLS uses a Level 3 (L3) certificate network engineered for high-assurance security requirements . It's fully PCI and FedRAMP compliant, which makes it best for sites handling sensitive data like PII, e-commerce transactions, or financial data. It also supports specialized non-SNI configurations for older legacy clients that don't send TLS SNI headers.

Enhanced TLS uses the edgekey.net suffix for edge hostnames.

Certificate type

Certificates authenticate your site's identity and enable secure, encrypted communication between edge servers and a user's browser. They ensure data integrity and privacy by verifying that the domain is legitimate and protecting against unauthorized usage. See Validate domain ownership and certificates for details on provisioning your certificates.

Setup

For the automatically created Primary hostname set, this setting is locked once you create a workspace. You can specify the certificate type for any new service hostname set that you add.

For secure traffic delivery, you can choose between Default Domain Validation (DV) and certificates managed through Certificate Provisioning System (CPS). The primary technical distinction lies in the level of administrative control versus the degree of automation provided.

Default Domain Validation (DV) certificate

Default DV is an automated certificate service that provisions Domain Validated certificates issued by Let's Encrypt. The system automatically and transparently handles provisioning, edge deployment, and renewals. It supports DNS CNAME, DNS-01, and HTTP-01 validation methods to prove domain control. Default DV is designed for high-scale automation without manual certificate overhead or slot management.

CPS-managed

CPS-managed certificates are assets that you define, control their lifecycle and provide technical specifications. They support complex security architectures that require specific Certificate Authorities (CAs), Subject Alternative Name (SAN) configurations, or organization-validated (OV) and extended-validation (EV) standards. You are responsible for configuring the certificate slot, selecting the cipher profiles, and initiating renewals within Certificate Provisioning System (CPS).

Edge hostname assignment

An edge hostname is a DNS-based CNAME target that directs end-user traffic for your service hostname to the optimal edge server rather than your origin. It consists of a prefix, usually your service hostname, and an Akamai-specific suffix related to a security level for client-to-edge traffic:

• For Standard TLS, the system appends the .edgesuite.net suffix.
• For Enhanced TLS, the system appends the .edgekey.net suffix.

The final edge hostname combines the two, for example www.example.com.edgesuite.net.

Setup

By default, each service hostname in a set is automatically assigned a unique, system-generated edge hostname with IPv6 + IPv4 support. As a result, every service hostname maps to its own distinct edge hostname record.

You can override this unique assignment by editing individual service hostnames.