[Yandex Cloud documentation](../../../index.md) > [Yandex Object Storage](../../index.md) > [Step-by-step guides](../index.md) > Hosting static websites > Configuring HTTPS

# Configuring HTTPS

If you use a bucket without a period in its name to [host a static website](../../concepts/hosting.md), that website will be accessible by default over HTTP and HTTPS at the following URLs:

* `http(s)://example.website.yandexcloud.net`
* `http(s)://website.yandexcloud.net/example`

This bucket does not require uploading your own security certificate, but it also does not support your own domains.

If you use a bucket with a period in its name to host a static website, that website will be accessible by default over HTTP and HTTPS at the following URLs:

* `http://example.com.website.yandexcloud.net`
* `http(s)://website.yandexcloud.net/example.com`

This bucket also [supports your own domains](own-domain.md). By default, when addressing the website by domain name, it is only accessible over HTTP, e.g., at `http://example.com`. To make your website accessible by its domain name over HTTPS, upload your own security certificate and the applicable secret key.


{% note alert %}

Starting August 1, 2025, Object Storage no longer supports the TLS protocol versions 1.0 and 1.1.

For more information, see [TLS protocol](../../concepts/tls.md).

{% endnote %}


Object Storage only supports [PEM](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail)-encoded certificates.

{% note info %}

The bucket becomes accessible over HTTPS within 30 minutes of uploading the certificate.

Request redirects from HTTP to HTTPS are enabled automatically once you set up HTTPS access to a bucket. No other settings are required.

{% endnote %}

## Selecting a certificate from Certificate Manager {#cert-manager}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select a folder.
    1. Navigate to **Object Storage**.
    1. Select the bucket from the list.
    1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
    1. Select the **HTTPS** tab.
    1. Click **Configure**.
    1. In the **Source** field, select **Certificate Manager**.
    1. In the **Certificate** field, select the certificate from the list that opens. 
    
        {% note info %}
        
        If you do not have a certificate in Yandex Certificate Manager yet, click **Go to Certificate Manager** and follow [this guide](../../../certificate-manager/quickstart/index.md) to create your first certificate.
        
        {% endnote %}

    1. Click **Save**.

- Yandex Cloud CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for editing a bucket ACL:

     ```bash
     yc storage bucket update --help
     ```  

  1. Run this command:

     ```bash
     yc storage bucket set-https --name <bucket_name> --certificate-id <certificate_ID> 
     ```  

     Where:
     * `--name`: Name of the bucket to configure HTTPS for.
     * `--certificate-id`: Certificate ID in Certificate Manager.

     Result:

     ```text
     source_type: SOURCE_TYPE_MANAGED_BY_CERTIFICATE_MANAGER
     certificate_id: fpqe2g0hfr0e********
     ```

- Terraform {#tf}

  {% note info %}
  
  If you access Object Storage via Terraform under a [service account](../../../iam/concepts/users/service-accounts.md), [assign](../../../iam/operations/sa/assign-role-for-sa.md) to the service account the relevant [role](../../security/index.md#roles-list), e.g., `storage.admin`, for the folder you are going to create the resources in.
  
  {% endnote %}
 
  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  
  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.



  To select a certificate from Certificate Manager:

  1. Open the Terraform configuration file and add the `https` section to the bucket description:

     ```hcl
     ...
     resource "yandex_storage_bucket" "b" {
       bucket = "my-policy-bucket"

       https {
         certificate_id = "<certificate_ID>"
       }
     }
     ...
     ```

     Where:
     * `certificate_id`: Certificate ID in Certificate Manager that will be used for the bucket.

     For more information about the `yandex_storage_bucket` properties in Terraform, see [this provider guide](../../../terraform/resources/storage_bucket.md#bucket-https-certificate).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

     You can check the selected certificate using the [management console](https://console.yandex.cloud).

- API {#api}

  To select a certificate from Certificate Manager, use the [setHTTPSConfig](../../api-ref/Bucket/setHTTPSConfig.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource or the [BucketService/SetHTTPSConfig](../../api-ref/grpc/Bucket/setHTTPSConfig.md) gRPC API call.

{% endlist %}

## Uploading a custom security certificate {#own}

To [upload](../../../certificate-manager/operations/import/cert-create.md) a custom certificate, use Certificate Manager.

When uploading a certificate chain, make sure it starts with the domain certificate and ends with the root one. To create a chain file, use the following command:

```bash
cat domain.pem intermediate.pem rootca.pem > bundle.pem
```

Where `domain.pem` is the domain certificate, `intermediate.pem` is the intermediate certificate, `rootca.pem` is the root certificate, and `bundle.pem` is the resulting chain.

To upload a certificate:

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select a folder.
   1. Navigate to **Object Storage**.
   1. Select the bucket from the list.
   1. In the left-hand panel, select ![image](../../../_assets/console-icons/persons-lock.svg) **Security**.
   1. Select the **HTTPS** tab.
   1. Click **Configure**.
   1. In the **Source** field, select **Your certificate**.
   1. Add **Certificate** and **Secret key**.
   1. Click **Save**.

- API {#api}

  To upload a custom security certificate, use the [setHTTPSConfig](../../api-ref/Bucket/setHTTPSConfig.md) REST API method for the [Bucket](../../api-ref/Bucket/index.md) resource or the [BucketService/SetHTTPSConfig](../../api-ref/grpc/Bucket/setHTTPSConfig.md) gRPC API call.

{% endlist %}

{% note info %}

You can get files from a publicly available bucket using a public link via both HTTP and HTTPS even if no website hosting is [configured](setup.md) for the bucket. In this case, a cloud-level certificate from [GlobalSign](https://www.globalsign.com) will be used for HTTPS access.

{% endnote %}

### See also {#see-also}

* [How do I fix an incorrect MIME type of objects when uploading them to a bucket?](../../qa.md#qa-mime-type)
* [Setting up hosting](setup.md)
* [Custom domain](own-domain.md)
* [Support for multiple domain names](multiple-domains/index.md)