This certificate protects the first stage of the request flow—the request from an end user (client) that's received by ​Akamai​ edge servers. In some cases, you may need to create this certificate before you create your property.

Understand the levels of security

There are various levels of security you can apply:

For a more detailed comparison, see Compare the security options.

Use the default certificate method

Also referred to as "secure by default," this method supports both Standard TLS and Enhanced TLS security. This is an automated approach to creating the certificate. When you set up the connection between your website or app and the ​Akamai​ edge network—this is called a "property hostname"—you select the level of security you want to use. ​Akamai​ automatically creates and provisions the certificate for you and applies it to your Ion property.

You don't need to create a certificate ahead of time or perform any additional prerequisites. Later, when you're creating your Ion property, you'll set a couple of options to apply this method.

📘

Secure by default is LA

This is an additional service for Property Manager that needs to be added to your contract. However, it hasn't been released to general availability yet. So only a select number of customers can use it. Contact your account team to see if you're eligible. Otherwise, you need to use a custom certificate.

Use the custom certificate method

If you don't have access to the secure by default method, or you want your own custom certificate, you can create one manually. This method supports both Enhanced TLS and Standard TLS securities.

🚧

Custom certificates can take a while to provision, and you need one before you can set up your Ion property for secure delivery. So, we recommend that you create one first.

Custom certificates via the Certificate Provisioning System (CPS)

CPS is a separate ​Akamai​ utility you can use to generate a custom certificate. All certificates are signed by a Certificate Authority that is known to be trusted by every major browser or operating system. See the Certificate Provisioning System user documentation for instructions on this process. There are multiple phases of the process, and you need to apply specific settings:

1. When you enter certificate information, you'll set your hostname as either the Common Name (CN) or a Subject Alternate Name (SAN). Make note of it, because you need this value later in the process.

2. During the select network setting phase, set Deployment Network to the desired level of security, Standard TLS or Enhanced TLS.

3. Set all other options for all other phases of the certificate creation process as desired.

Certificates can take upwards of three hours to provision, based on the level of security you've chosen. The email address set for the ​Control Center​ account that created the certificate will receive an email when it's ready.

Custom certificates via a third-party vendor

Talk to your ​Akamai​ account team for information on supported third-party vendors. Work with a supported vendor to set up an Enhanced TLS or Standard TLS certificate. Then, you need to:

• Make note of the exact domain used to access it from the third-party vendor.
• Provide the certificate to your account team.

Your account team will contact you when the certificate has been fully provisioned for use.

Use the ​Akamai​ shared certificate

This lets you quickly incorporate HTTPS delivery by selecting this certificate type while applying the hostname for your site or app in a property hostname. Its level of security is comparable to Standard TLS.

You don't need to create a certificate ahead of time or perform any additional prerequisites.

Compare the security options

There are various security options available for your configuration, based on the level of HTTPS security you apply in your edge certificate. Review the table here to make sure you're choosing the right level of security.

📘

Consider these points:

• Specific details may vary in corner cases and for older products that aren't listed. Check with your account team for details. Security properties listed should be taken as rough suggestions and may not apply to all scenarios.

• All that's listed is also supported with plain text HTTP requests to the same hostname. No security properties are obtained unless HTTP traffic is redirected to HTTPS. Once you commit to HTTPS-only, HSTS can be used to indicate to clients that HTTP is no longer supported. But, there is no going back.

• Non-secure HTTP is also available, but it's not recommended. It's included in this table for comparison.