The edge certificate protects the first stage of the request flow—the request from an end user (client) that's received by ​Akamai​ edge servers.

Review the available certificate options and plan which one would work best for you. With the CPS-managed certificate, you need to create it before you create your property.

Get to know the security levels

There are various levels of security you can apply:

For a more detailed comparison, see Compare the security levels.

Option 1: The CPS-managed certificate

This method supports both Enhanced TLS and Standard TLS secure delivery and it's available to all ​Akamai​ customers.

🚧

CPS-managed certificates can take a while to provision, and you need one before you can fully set up your Property Manager property for secure delivery. So, you should create one first.

Create certificates with CPS

The Certificate Provisioning System (CPS) is a separate ​Akamai​ utility you can use to generate a certificate. All certificates are signed by a Certificate Authority that is known to be trusted by every major browser or operating system.

Use ​Akamai Control Center​ to create the certificate

​Akamai​ offers a separate user interface in ​Control Center​ that you use to create certificates. See the Certificate Provisioning System user documentation for instructions on this process. During the select network setting phase, you set Deployment Network to the desired level of security, Standard TLS or Enhanced TLS. To make sure everything with your delivery is ready, test it on the staging network before pushing it to production.

Use an API to create the certificate

​Akamai​ also offers an application programming interface (API) that you can use to create your certificate, too. Have a look at the developer documentation for CPS for details.

Wait for the certificate to provision

Regardless of the tool you used, a certificate can take from 3 - 6 hours to provision, based on the level of security you've chosen. The email address set for the ​Control Center​ account that you used to create the certificate will receive an email when it's ready.

Create certificates via a third-party vendor

Talk to your ​Akamai​ account team for information on supported third-party vendors. Work with a supported vendor to set up an Enhanced TLS or Standard TLS certificate. Then, you need to:

• Make note of the exact domain used to access it from the third-party vendor.
• Provide the certificate to your ​Akamai​ account team.

Your account team will contact you when the certificate has been fully provisioned for use.

Option 2: The Default DV certificate

The Default Domain Validation (DV) certificate supports both Standard TLS and Enhanced TLS security. This is an automated approach to creating the certificate. When you set up the connection between your website or app and the ​Akamai​ edge network—using a property hostname—you select the level of security you want to use. ​Akamai​ automatically creates and provisions the certificate for you and applies it to your Property Manager property.

At this stage, you don't need to create a certificate perform any additional prerequisites. Continue with preparing your origin server.

📘

Default DV is LA

This is an additional service for Property Manager that needs to be added to your contract. However, it hasn't been released to general availability yet. So only a select number of customers can use it. Contact your account team to see if you're eligible. Otherwise, you need to use a CPS-managed certificate.

Option 3: The ​Akamai​ shared certificate

This lets you quickly incorporate HTTPS delivery by selecting this certificate type while applying the hostname for your site or app in a property hostname. Its level of security is comparable to Standard TLS

At this stage, you don't need to create a certificate perform any additional prerequisites. Continue with preparing your origin server.

Compare the security levels

There are various security options available for your configuration, based on the level of HTTPS security you apply in your edge certificate. Review the table here to make sure you're choosing the right level of security.

📘

Consider these points:

• Specific details may vary in corner cases and for older products that aren't listed. Check with your account team for details. Security properties listed should be taken as rough suggestions and may not apply to all scenarios.

• All that's listed is also supported with plain text HTTP requests to the same hostname. No security properties are obtained unless HTTP traffic is redirected to HTTPS. Once you commit to HTTPS-only, HSTS can be used to indicate to clients that HTTP is no longer supported. But, there is no going back.

• Non-secure HTTP is also available, but it's not recommended. It's included in this table for comparison.