Skip to main content
Every Tenbyte CDN distribution serves over TLS. You pick how the cert is provisioned and tune protocol-level options like SNI, redirects, and HTTP/2 / HTTP/3.

​
SSL types

Origin
TypeDNS validationBest for
Tenbyte SSL (Free)AutomaticSystem-generated *.tenbytecdn.com host. Zero setup.
Let’s EncryptDomain validation via HTTP-01 / DNS-01Custom domains where you control DNS. Free, auto-renews.
Custom SSLYou manageBring-your-own cert (EV, wildcard, internal CA, multi-SAN).

​
Provision a certificate

​
Tenbyte SSL (free)

Auto-issued for the system-generated hostname. Nothing to configure.

​
Let’s Encrypt

  1. Pick Let’s Encrypt as the SSL type.
  2. Confirm the custom domain CNAMEs to your distribution: 
    dig +short cdn.yoursite.com CNAME
# cdn.yoursite.com.   CNAME   your-distribution.tenbytecdn.com.
  3. Click Issue certificate. Validation runs automatically.
  4. Status moves from Pending → Active once issued. Auto-renewal handles future cycles.

​
Custom SSL

Upload an existing cert. See Custom Certificates for the full upload flow and PEM format.

​
Verify the cert

openssl s_client -connect cdn.yoursite.com:443 -servername cdn.yoursite.com </dev/null \
  2>/dev/null | openssl x509 -noout -subject -issuer -dates
Expected output: 
subject=CN = cdn.yoursite.com
issuer=C = US, O = Let's Encrypt, CN = R3
notBefore=May  9 00:00:00 2026 GMT
notAfter=Aug  7 23:59:59 2026 GMT
For browsers, hit the URL and check the lock icon. SSL Labs (https://www.ssllabs.com/ssltest/) gives you a deeper grade.

​
Additional SSL settings

Origin
SettingWhat it doesWhen to use
SNI HostnameSent during the TLS handshake.Set if your origin’s TLS cert doesn’t match the distribution hostname.
Redirect HTTP → HTTPSSends 301 for any plain-HTTP request.Always on for production.
HTTP/2Multiplexed connections.Always on — universally supported.
HTTP/3 (QUIC)UDP-based transport, faster on lossy networks.On for end-user-facing distributions; off if you have strict-firewall users.

​
Verify the protocol

# HTTP/2
curl --http2 -o /dev/null -sS -w 'HTTP version: %{http_version}\n' "https://cdn.yoursite.com/"

# HTTP/3
curl --http3 -o /dev/null -sS -w 'HTTP version: %{http_version}\n' "https://cdn.yoursite.com/"

​
Renewal and rotation

Cert typeRenewal
Tenbyte SSLAutomatic. No action needed.
Let’s EncryptAutomatic, ~30 days before expiry. Failures emit a webhook.
Custom SSLYou are responsible. Watch notAfter and upload the new cert before it expires.
For custom certs, set a calendar reminder 30 days before notAfter and a hard alert 7 days before.

​
Operational tips

  • Mixed-content audits — once HTTPS redirect is on, scan your site for http:// asset URLs.
  • HSTS — add Strict-Transport-Security via response headers only after you’re sure all subdomains are HTTPS.
  • Cipher / version — Tenbyte CDN serves TLS 1.2 and 1.3 with modern cipher suites. Older clients (XP, ancient Android) won’t connect.
  • Origin TLS — the edge talks TLS to your origin too. If you use a self-signed cert, mark the origin as such; otherwise the cert must validate.

​
Troubleshooting

SymptomFix
Cert stuck at PendingDNS not resolving to the distribution. Confirm CNAME and wait for TTL to expire.
Browser shows cert mismatchSNI Hostname misconfigured, or DNS resolves to a different distribution.
Origin handshake failsSet the SNI Hostname to match the origin’s cert CN.
Mixed-content warningsYour HTML still references http://... assets. Update or rely on protocol-relative URLs.
HTTP/3 not negotiatedClient or network blocks UDP/443. Falls back to HTTP/2 silently.