Alibaba Cloud reseller contact Alibaba Cloud SSL Certificate Deployed on CDN Showing 'Not Secure' Error

If you already uploaded an SSL certificate to Alibaba Cloud CDN but the browser still shows “Not Secure”, the problem is usually not the certificate itself. In most cases, the browser is telling you that the actual page being loaded is still not fully HTTPS, or that the CDN configuration is not serving the certificate you think it is.

In real projects, this issue often appears right after a purchase, renewal, or account verification change. The certificate is bought or uploaded successfully, but the site still shows warnings because of CDN domain binding, origin settings, redirect rules, cache, mixed content, or account-side restrictions that delay activation.

This article focuses on the questions users usually care about when they are trying to solve the problem for a live site:

• Why does Alibaba Cloud CDN still show “Not Secure” after SSL deployment?
• What should I check first if I just bought the certificate?
• Do I need identity verification before buying SSL or CDN?
• Which payment method is safest for certificate renewal?
• Why does Alibaba Cloud sometimes hold purchases or renewals for risk review?
• How much does it cost compared with free certificates or other cloud providers?

What Usually Causes the “Not Secure” Warning

For CDN-based HTTPS, the certificate being “uploaded” is only one step. The browser warning usually comes from one of these operational issues:

• The domain is still being accessed through http:// instead of https://.
• The CDN domain has not been bound to the certificate inside the CDN console.
• The certificate is attached to the wrong CDN domain or wrong region.
• The browser is loading mixed content, such as images, scripts, or APIs over HTTP.
• The origin server is returning redirects or headers that force the browser back to HTTP.
• The certificate chain is incomplete or the private key does not match the certificate.
• The CDN edge node has not fully propagated the new SSL configuration.
• The site is accessed through the origin domain, not the CDN CNAME domain.

If you only remember one thing: CDN HTTPS must be configured end-to-end. A valid certificate on Alibaba Cloud does not help if the browser is still reaching an HTTP URL, a non-CDN endpoint, or a page that loads insecure resources.

Fastest Fix Checklist

Before changing anything complicated, I usually check these items in order. This is the fastest path when the site is already online and the goal is to remove the warning quickly.

1. Confirm the browser URL is using https://your-domain, not http://.
2. Open the CDN console and verify the certificate is bound to the exact accelerated domain.
3. Check that the CDN domain points to the Alibaba Cloud CNAME, not directly to the origin.
4. Turn on forced HTTPS or HTTP-to-HTTPS redirect in CDN settings.
5. Inspect the page source and browser console for mixed content.
6. Verify the certificate chain and private key match.
7. Wait for CDN propagation, then test from multiple regions and browsers.

In many cases, the warning disappears only after you fix both the CDN layer and the web application layer. For example, the CDN may be serving HTTPS correctly, but the page still loads images from http://, which triggers a warning in modern browsers.

Where People Usually Go Wrong in Alibaba Cloud CDN SSL Setup

1) Certificate uploaded, but not bound to the CDN domain

This is the most common mistake. Users buy or upload a certificate under the SSL service, then assume it automatically applies to every CDN domain in the account. It does not. The certificate must be explicitly selected in the CDN domain configuration.

If you run multiple domains, double-check that each accelerated domain has the correct certificate attached. In enterprise environments, I have seen teams deploy a certificate to the production domain while the actual traffic was still going through a test or legacy CDN hostname.

2) Accessing the origin instead of the CDN domain

This one is easy to miss. The certificate is on the CDN edge, not necessarily on the origin server. If someone types the origin server IP, a backend hostname, or the old website URL, the browser may still show “Not Secure” because the origin is not configured for HTTPS.

For a proper CDN deployment, users should access the site through the CDN CNAME or the configured CDN alias. If the business still exposes the origin server publicly, you need to decide whether the origin should also be hardened with SSL or locked down by IP allowlist.

3) Mixed content after HTTPS is enabled

The page may open with a secure lock icon, but still show a warning or broken security state when the browser detects insecure subresources. Common offenders:

• Old image URLs hardcoded as http://
• Alibaba Cloud reseller contact JavaScript loaded from third-party HTTP endpoints
• API requests still using HTTP
• Embedded iframes or analytics tags that are not HTTPS-ready

If the site uses a CMS, check theme templates, plugin settings, and database-stored URLs. If it uses a custom frontend, search the codebase for plain HTTP references before you blame the certificate.

4) HTTPS enabled, but redirect not enforced

Some sites have a valid certificate but still allow HTTP. Browsers may show “Not Secure” if the user lands on the HTTP version first and the site does not redirect immediately. In CDN deployments, enable the HTTP-to-HTTPS redirect rule rather than relying on application code alone.

This matters more than people expect. Search engines, mobile browsers, and embedded webviews often cache the first URL they see. If the first response is HTTP, the user may never notice the secure version unless the redirect is properly configured.

5) Certificate chain or key mismatch

If the certificate file, private key, or intermediate chain is incomplete, the browser may distrust the certificate even though Alibaba Cloud accepted the upload. This often happens when:

• Alibaba Cloud reseller contact The wrong PEM bundle is uploaded
• The private key belongs to a different CSR
• The renewal package was downloaded but not re-deployed everywhere
• Someone copied only the leaf certificate and skipped the chain

For production, I recommend keeping the certificate package versioned and recording the exact domain, expiration date, and upload time. When renewals happen under pressure, teams often reuse the wrong key file or deploy an incomplete bundle.

Alibaba Cloud reseller contact What to Check in Alibaba Cloud Account Setup Before Buying the Certificate

Many SSL and CDN issues begin before deployment, during account setup. If the account is not fully verified, funded, or approved for the required service, the purchase may succeed partially, but the service can still be blocked, limited, or delayed by compliance review.

Identity verification and KYC

In Alibaba Cloud International and region-specific accounts, identity verification requirements vary by product and billing profile. For SSL certificates, CDN, and other paid cloud services, the account may need real-name verification before:

• Buying the certificate
• Binding the certificate to CDN
• Increasing spend limits
• Enabling invoice or enterprise billing
• Using certain payment methods

If the account is newly created, do not wait until certificate expiration day to complete KYC. I have seen teams lose a production renewal window because the account entered a manual verification queue after a billing anomaly or a mismatched identity document.

Common KYC failure points

• Business name does not match the bank card or billing profile
• Document translations are inconsistent with the registered entity name
• Country or region of registration does not match the operating entity
• Enterprise documents are outdated or unsigned
• Billing contact and legal contact use different identities without explanation

If you are buying for a client or a subsidiary, keep a record of who owns the Alibaba Cloud account, who pays for it, and who is authorized to renew it. This sounds administrative, but it is often the difference between a smooth renewal and a blocked payment during an expiry window.

Payment Methods and Renewal Strategy

SSL and CDN are easy to underbudget because the monthly traffic bill looks manageable while the certificate renewal is forgotten. The real operational risk is not the initial cost; it is missing the renewal because the account cannot pay on time.

What payment methods people actually use

Depending on account region and verification status, Alibaba Cloud International accounts may support different payment methods such as credit card, debit card, PayPal, bank transfer, or enterprise invoicing arrangements. Availability changes by country and account type, so you should verify the payment methods shown in your own billing console rather than assuming a global rule.

In practice:

• Credit card is usually the fastest for one-off SSL purchases and emergency renewals.
• PayPal can be useful for small teams that want a secondary payment route.
• Bank transfer / enterprise billing is better for predictable annual procurement, but slower to activate.
• Prepaid balance helps avoid payment failures, but only if you monitor top-up timing.

Renewal best practice

For production domains, I recommend the following:

• Set an internal reminder at least 30 days before certificate expiry.
• Alibaba Cloud reseller contact Keep one backup payment method on the account.
• Pre-fund the account if your organization uses invoice-based procurement.
• Check whether the SSL provider issues a one-year or multi-year renewal option.
• Verify whether the new certificate requires re-binding to each CDN domain after renewal.

Renewal mistakes are expensive because the failure often appears only after the certificate expires or the edge cache starts serving stale configuration. In those cases, users see security warnings even though the renewal order has already been placed.

Risk Control and Compliance Reviews

Alibaba Cloud, like other cloud providers, may place some purchases or account actions under risk control review. This is especially common when the account shows one or more of the following:

• New account with no spending history
• Card country and account region do not match
• Alibaba Cloud reseller contact Rapid repeated purchases
• VPN or cross-border login patterns
• Certificate or CDN purchase for a domain with suspicious registration details
• Frequent payment failures followed by retries

From a user perspective, this is frustrating because the product may appear available, but the action is still pending manual review. If you are operating in a business environment, prepare for this early:

• Alibaba Cloud reseller contact Use consistent company information across cloud account, billing profile, and domain ownership.
• Keep a clear record of the website domain, business purpose, and contact person.
• Avoid switching cards or payment countries right before a renewal.
• Make large or unusual purchases from a stable account environment, not a newly created login.

I have seen small teams delay a certificate renewal by several days simply because the payment was made with a new card from a different country. That is not a technical problem; it is a billing risk decision. For a live CDN service, this can still create a real outage window if the certificate expires.

Account Usage Restrictions That Affect CDN SSL

Some users think the SSL problem is purely a browser issue, but there are account-side restrictions that can affect the outcome:

• Alibaba Cloud reseller contact The account is limited to trial or low-risk usage.
• CDN features are available, but certificate binding is restricted until verification completes.
• The account can buy a certificate, but not enable the intended region or domain class.
• Some products require a verified business profile before enterprise-grade billing is unlocked.
• Traffic or security actions may be throttled if the account is under review.

If you are buying for a customer-facing site, check these restrictions before making promises about deployment timing. A certificate that is purchased but not operational is not useful for launch, migration, or renewal work.

Cost Comparison: Alibaba Cloud SSL vs Free Certificates vs Other Options

Alibaba Cloud reseller contact Users often ask whether they should buy SSL on Alibaba Cloud, use a free certificate, or purchase from a third party. The answer depends on the deployment model and the team’s tolerance for manual renewal.

The cheapest option is not always the cheapest operationally. If your team forgets renewals, a free certificate can become the most expensive choice because the incident cost is much higher than the certificate itself. On the other hand, if your environment changes frequently and your DevOps process is mature, a free certificate plus automation may be perfectly adequate.

For Alibaba Cloud users who already depend on CDN, the practical decision is usually this:

• Use a free certificate for labs, staging, and short-lived sites.
• Use a paid certificate if the domain is customer-facing and the business wants less renewal risk.
• Use enterprise validation if procurement, audit, or trust requirements matter.

Real-World Scenarios

Scenario 1: The certificate was issued, but the site is still HTTP

A marketing team buys an SSL certificate on Alibaba Cloud, uploads it to CDN, and announces launch. The browser still shows “Not Secure.” The root cause is usually that the website still opens on the old HTTP link from ads, QR codes, or a bookmark. The CDN certificate is valid, but the entry point is wrong.

Fix: enforce redirect at the CDN layer, update the canonical site URL, and replace all public links with the HTTPS version.

Scenario 2: The CDN is correct, but images are loaded from HTTP

This happens a lot on legacy CMS sites. The main page loads securely, but product images or embedded scripts are still called from HTTP. Modern browsers downgrade trust and may display a warning state.

Fix: search-and-replace old URLs, update CMS settings, and use HTTPS-only third-party assets.

Scenario 3: Renewal succeeded, but users still see the old certificate

The new certificate is already uploaded, but some users still see the expired one because of CDN propagation or cached browser state. This is common when multiple edge points and DNS caches are involved.

Fix: wait for full propagation, test from different networks, and verify that all CDN domains are bound to the same renewed certificate.

What I Recommend Before You Buy or Renew

If your goal is to prevent a “Not Secure” incident rather than just respond to it, use this checklist before you purchase or renew:

• Confirm the Alibaba Cloud account is verified and able to pay without review delays.
• Make sure the billing profile matches the legal entity that owns the domain.
• Choose a payment method that will still work on the renewal date.
• Map each production domain to the exact CDN domain that will carry the certificate.
• Document the redirect rules, origin configuration, and certificate expiry dates.
• Keep a fallback certificate plan for emergency renewal windows.

For teams operating multiple websites, the most practical approach is to centralize certificate tracking. A simple spreadsheet with domain name, expiry date, payment method, owner, and CDN binding status is often enough to prevent avoidable downtime.

Frequently Asked Questions

Why does Alibaba Cloud CDN still show “Not Secure” after I uploaded SSL?

Because upload alone does not activate secure browsing. Check certificate binding, HTTPS redirect, mixed content, and whether traffic is actually going through the CDN hostname.

Do I need identity verification before buying SSL or CDN?

In many accounts, yes. Requirements vary by region and product. If the account is not fully verified, purchases can be blocked, delayed, or placed under manual review.

Can I use a credit card for SSL renewal?

Often yes, but availability depends on account region and billing settings. For production, it is safer to keep a backup payment method and renew early instead of waiting for the expiry date.

Why was my SSL order held for review?

Common triggers include new accounts, unusual payment geography, repeated attempts, mismatched company details, or account behavior that looks risky to the billing system.

Is a free certificate enough for Alibaba Cloud CDN?

It can be enough for small or short-lived sites, but you need strong renewal discipline. For a live business site, the hidden cost is often operational, not the certificate price.

Why do I still see the warning after switching to HTTPS?

Usually because the page loads some resources over HTTP, or the browser is still entering the site through an old link, cached redirect, or origin hostname.

Practical Takeaway

Alibaba Cloud reseller contact If Alibaba Cloud CDN shows “Not Secure” after SSL deployment, do not start by replacing the certificate. Start by checking the traffic path, binding, redirects, and mixed content. At the same time, make sure the account side is healthy: verified identity, working payment method, and no pending compliance review. In real operations, browser warnings are often caused by a combination of technical setup and billing friction, not by a broken certificate alone.

If you are planning a purchase or renewal now, the safest sequence is:

1. Verify the Alibaba Cloud account status and billing readiness.
2. Buy or renew the certificate early, not on the expiration day.
3. Bind it to the exact CDN domain.
4. Force HTTPS and remove mixed content.
5. Test from different regions and devices before declaring the issue solved.