Skip to main content

Huawei Cloud module

Uploads a certificate to Huawei Cloud's native certificate store. For CDN it also writes the certificate into the domain's HTTPS configuration; for ELB and WAF it manages the certificate object only and never calls the listener or protected-domain APIs — you bind the object once in the console and every renewal follows automatically. Uses AK/SK (access key + secret key) authentication scoped to the region where your resources live.

Overview​

  • Transport: Huawei Cloud REST APIs, signed with the SDK v4 signing algorithm.
  • Auth: Access Key + Secret Key pair (AK/SK). Generated in My Credentials.
  • Scope: one region per target. Multi-region deployments use separate targets.
  • Supported services:
    • ELB (Elastic Load Balance) — listener HTTPS cert.
    • CDN — domain HTTPS configuration.
    • WAF — host TLS certificate.
  • Rollback: supported — a rollback re-uploads/re-binds a previous retained certificate version on ELB/WAF/CDN (Rollback).

Prerequisites​

  • A Huawei Cloud account + IAM user with AK/SK and the minimum policies:
    • SCM Administrator (or a custom policy granting create/list/delete certificate).
    • One of: ELB ReadOnlyAccess + ELB Update Listener, or CDN ReadOnlyAccess + CDN Domain HTTPS Config, or WAF ReadOnlyAccess + WAF Update Certificate — depending on which service(s) you target.
  • The IDs of the ELB listener / CDN domain / WAF host you will update (looked up from the Huawei console or via CLI).

Create the module credential​

  1. Settings → Distribution → Credentials → New → Huawei Cloud.
  2. Access Key + Secret Key. Stored envelope-encrypted.
  3. Save.

Create a Huawei Cloud target​

  1. Settings → Distribution → Targets → New. Module: Huawei Cloud.
  2. Fields:
    • Region — e.g. ap-southeast-1, cn-north-4. Must match the region of the target resource.
    • Project ID — required for most services; shown in My Credentials → API Credentials.
    • Credential.
    • Service scope: pick one:
      • ELB — certificate object only. CertAutoPilot creates or updates the ELB certificate; it does not touch listeners. Bind the object to your listener once in the console.
      • CDN — domain name. The certificate is written straight into the domain's HTTPS configuration. Note this sets the domain's HTTPS status to on: distributing to a CDN domain that currently has HTTPS disabled will enable it.
      • WAF — certificate object only, same as ELB. Bind it to the protected domain once in the console.
    • Certificate name — optional. Empty = auto-generated per certificate as cap-<token>-<domain> (token: 8-char hash derived from the certificate, stable across renewals; max 32 chars) — recommended so one target can serve multiple certificates, since ELB/WAF resolve certificates by exact name. Per certificate, the name (and ELB/WAF certificate_id adoption or the CDN domain) can be overridden from the certificate's Distributions → Overrides drawer. :::note Pure-legacy targets Targets whose remote state predates per-certificate keying re-resolve by exact name/domain lookup once per run; a manual duplicate name created in the console surfaces as a Conflict — set certificate_id in the override to disambiguate. :::
  3. Save → health check calls GET /v3/<project_id>/scm/certificates?limit=1.

Execution flow​

  1. Resolve the certificate name — precedence is explicit target certificate_name > per-distribution override > auto cap-<token>-<domain> (max 32 chars). On first distribution the module creates the certificate object under that resolved name; on renewal it looks the same object up by name (or by an adopted certificate_id) and updates it in place rather than minting a new one.
  2. For CDN, the certificate is written into the domain's HTTPS configuration. For ELB and WAF there is no second step: the certificate object is the whole deployment, and whatever already references that object picks up the new material.
ELB and WAF need a one-time bind, or nothing serves the certificate

Because no listener or protected-domain API is called, a first ELB/WAF deployment creates a certificate object that nothing references yet. The run reports success and changed, but the VIP keeps serving the old certificate — and will keep doing so on every renewal until someone binds the object in the Huawei console.

Bind it once, then leave the name alone: renewals update that same object in place and the binding follows. Add a tls_fingerprint validation endpoint pointed at the VIP so a missing bind fails the deployment instead of passing silently. (CDN is not affected — it binds directly.)

  1. Old cert versions replaced in place; any stale cross-service reference is left untouched — Huawei rejects delete while a cert is referenced, and we never delete cross-service.

Rollback​

Supported via previous-version re-deploy: a rollback re-uploads a previous retained certificate version and re-binds it on the ELB listener / WAF host / CDN domain — the module's normal deploy path, fed older material. Eligibility, the version picker, and auto-rollback: Rollback.

Troubleshooting​

"Forbidden"​

IAM user lacks a required policy. Check IAM → Users → Permissions and grant either the stock policy or a custom one covering the API call the module just made (visible in the backend logs).

"Resource not found in region X"​

Target resource lives in a different region than the target config says. Huawei resources are regional — verify in the console.

"Invalid project ID"​

Project IDs differ per region; you can't reuse one across regions. Look up the project ID for the resource's region.

See also​

Fields the setup steps do not mention​

  • Credential domain_id — part of the AK/SK credential JSON. It is required for CDN (a global service): without it every CDN deploy, health check and dry run fails with CREDENTIAL_MISSING. Save-time validation does not require it, so the gap only surfaces at deploy time.
  • Target enterprise_project_id — sent on every WAF call; set it when your WAF resources live in a non-default enterprise project.

Idempotent skip​

All three sub-services skip the upload and report success with no change when the live certificate's content hash and the resolved name both already match. A name-only change is deliberately not skipped, so renaming still takes effect.