In this tutorial, you learn how to quickly order a Let’s Encrypt certificate by using IBM Certificate Manager and IBM Cloud Internet Services (CIS) so that you can protect your domain.

Additionally, you will learn how to use page rules in CIS so that you can serve cached content that is stored in an IBM Cloud Object Storage bucket.

This tutorial uses the following services:

• IBM Cloud Certificate Manager: Obtain, store, and manage TLS certificates that you use for IBM Cloud or other cloud and on-premises deployments.
• IBM Cloud Internet Services (CIS): Manage all fronts of your domains, including web application firewall (WAF), DDoS, CDN, firewall rules, load balancing and more.
• IBM Cloud Object Storage: A flexible, cost-effective, and scalable cloud storage for unstructured data.

Let’s get started!

1. Provision service instances

From the IBM Cloud catalog, provision instances of the following services:

• IBM Cloud Certificate Manager
• IBM Cloud Internet Services (CIS)
• IBM Cloud Object Storage

2. Store a file in IBM Cloud Object Storage

In your Cloud Object Storage instance, follow these steps:

1. Click Create Bucket.
2. Create a bucket of your choosing.
3. Upload a file (e.g., an image).
4. Go to Access policies > Public Access to create a public access policy:

3. Register a domain in IBM Cloud Internet Services (CIS)

In your CIS instance, add a domain and configure its DNS information. To learn more about using CIS to register a domain, check out the getting started tutorial.

4. Enable page rules to serve cached content

After you register a domain in your CIS instance, follow these steps:

1. Select your domain and go to Performance > Page rules.
2. In the Rule behavior section, select the Resolve override with COS setting:

3. Select your Cloud Object Storage instance and bucket.
4. Click Create to generate a cdn CNAME record:

5. Go to Reliability > DNS.
6. In the DNS records section, find your newly created CNAME record.
7. Set the Proxy option for the record to ‘on’:

Copy the fully qualified URL of the DNS record. We will use it later.

At this point, you have configured your CIS instance to cache and serve your Cloud Object Storage bucket content. However, it is not yet protected using a certificate that is managed by Certificate Manager. To achieve this, let’s create an authorization so that Certificate Manager can order a certificate for your domain.

5. Create an authorization between services

In the IBM Cloud console, follow these steps:

1. Go to Manage > Access (IAM) > Authorizations.
2. Click Create.
3. From the Source service list, select your Certificate Manager instance.
4. From the Target service list, select your CIS instance.
5. In the Service access section, select the Manager role. By selecting the Manager role, you assign Certificate Manager the access it needs to manage all of your registered domains in CIS. If you’d like to assign more granular access, you can provide the ID of a specific domain instead.
6. Click Authorize.

With service-to-service authorization in place, you can now order a certificate.

6. Order a certificate from Certificate Manager

In your Certificate Manager instance, follow these steps:

1. Click Order certificate.
2. Provide the certificate details.
3. Select your CIS instance and your domain.
4. Click Order.

After the certificate becomes available, let’s download it and then upload it to CIS.

7. Upload the certificate to CIS

In your Certificate Manager instance, follow these steps:

1. Click the dotted menu next to your certificate.
2. Click Download.

In your CIS instance, follow these steps:

1. Select your domain and go to the Security tab.
2. In the Edge certificates section, click Order.
3. In the side panel, click Upload.
4. Paste the certificate’s data and private key.
5. Click Add.

We’re all done. Let’s test this! In your browser, paste the fully qualified URL to see your image.

Next steps

In this tutorial, you learned how to protect a domain by using Certificate Manager and CIS and use page rules in CIS to serve cached content that is stored in Cloud Object Storage.

Want to learn more about managing SSL/TLS certificates with Certificate Manager? For more information, check out the IBM Cloud documentation. To share your questions, comments, raves, or concerns with us, use the Feedback button that can be found on any page of cloud.ibm.com.