SSL update in Cloud Manager

[ManjulaKumar]

We have Cloudflare as CDN and the SSL cert is updated there. 

When I update the SSL cert in Cloud Manager Domain Mapping the cert status shows as deployed and go live button shows up. 

Since this is only updating the expired cert, DNS configure is not required, so I click on go live button and press on ok.

The status doesnot change to verified. 

1. Since the cert is already updated in Cloudflare, is it not required to update the cert in Cloud Manager?

2. If it is required to also update the cert in cloud manager, how do I change the status from deployed to verified?

[HrishikeshKagne]

Hi @ManjulaKumar ,

Yes, you still need to update in Cloud Manager - Cloudflare only terminates traffic at the CDN edge, but Adobe’s Cloud Manager also needs the valid SSL cert for the domain mapping inside AEMaaCS. Both layers need the cert.

Why status stuck at “Deployed” - “Verified” only shows when the DNS CNAME/alias points correctly to Adobe’s edge and Cloud Manager can validate it. If you only replaced the cert but didn’t touch DNS, Cloud Manager won’t re-check until it can confirm ownership.
Re-upload the cert in Cloud Manager, click Go Live, and make sure the DNS record is still correctly pointing to Adobe’s edge hostname. Once Cloud Manager detects the DNS is good and the new cert is active, it will flip to Verified automatically.

• Cloudflare CDN cert ≠ AEMaaCS cert.
• You must also update in Cloud Manager.
• Status changes to “Verified” only after DNS validation passes with the new cert mapped.

[ManjulaKumar]

I ran the command curl -I https://yourdomain.com -H 'x-aem-debug:edge=true', it is showing x-cache:MISS. so it is reaching Adobe's Edge. So the record is pointing to Adobe's edge.  I will reupload the cert and see whether anything changes.

Can I use the same cert provided by third party for Cloudflare CDN and Cloud Manager?

[EstebanBustamante]

Hi @ManjulaKumar 

You don’t need to manage the certificate in Cloud Manager since you’re using your own CDN (Cloudflare). This approach is commonly referred to as BYOCDN (Bring Your Own CDN). You just need to make sure the necessary headers described below are passed from Cloudflare to your origin (AEM Publish server: publish-xxx-xxx.adobecloudaem.com).

Please check this out: https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/implementing/con... 

Hope this helps