What TLS does
During a TLS handshake, the browser verifies that a trusted certificate covers the requested hostname, negotiates encryption and creates a protected connection. HTTPS is HTTP carried over that connection.
Apply through ESA
- Finish connecting and activating the domain in ESA.
- Open the website’s Edge Certificates page.
- Choose the currently available free managed certificate option, such as Let’s Encrypt, and enter the exact hostname coverage required.
- Wait for domain control validation and issuance to succeed.
- Enable SSL/TLS and the HTTPS redirect only after HTTPS works directly.
Official documentation currently says ESA handles validation, deployment and automatic renewal for its free managed certificates. Let’s Encrypt limits and availability depend on the ESA plan and current terms.
Check current terms first. Do not assume certificates or ESA service remain permanently free. Plan quotas can change. Custom certificates require you to manage renewal.
Official Alibaba Cloud: Configure edge certificates →Verify hostname, chain and redirect
Open every hostname over HTTPS, confirm the certificate covers it, test expiration monitoring and verify that HTTP redirects without a loop. A padlock means the connection is encrypted; it does not prove the website itself is trustworthy.