Skip to main content

Huawei Cloud module

Creates or updates a certificate object in Huawei Cloud ELB (v3 API) or WAF (v1 API), or writes the certificate straight into a CDN (v2 API) domain's HTTPS configuration. For ELB and WAF the module manages the certificate object only and never calls the listener or protected-domain APIs — you bind the object once in the console and every renewal follows automatically. It never touches the SSL Certificate Manager (SCM) service. Uses AK/SK (access key + secret key) authentication.

Overview​

  • Transport: the Huawei Cloud Go SDK v3 (ELB v3, WAF v1, CDN v2 clients), AK/SK-signed. Each request has a 30 s timeout.
  • Auth: Access Key + Secret Key pair (AK/SK). Generated in My Credentials. CDN additionally needs the account's domain_id in the credential.
  • Scope: one sub-service and one object per target. ELB and WAF are regional (target region + project_id); CDN is global — its calls always go to cdn.myhuaweicloud.com and ignore the target's region and project_id.
  • Supported services:
    • ELB (Elastic Load Balance) — one server certificate object, updated in place.
    • WAF — one certificate object, updated in place.
    • CDN — one domain's HTTPS configuration.
  • Rollback: supported — a rollback re-runs the deploy with a previous retained certificate version, updating the same ELB/WAF object in place or rewriting the CDN domain's HTTPS configuration (Rollback). Nothing is bound or re-bound.

Prerequisites​

  • A Huawei Cloud account + IAM user with AK/SK. The IAM actions the module actually calls (grant only the group you target):
    • ELB: elb:certificates:list, elb:certificates:get, elb:certificates:create, elb:certificates:put (regional project scope).
    • WAF: waf:certificate:list, waf:certificate:get, waf:certificate:create, waf:certificate:put (regional project scope).
    • CDN: cdn:configuration:queryDomainList, cdn:configuration:queryDomains, cdn:configuration:modifyOriginConfInfo, cdn:configuration:modifyHttpsConf (Global services).
  • No listener, protected-domain or host IDs are needed. Optionally, the ID of an existing ELB/WAF certificate object to adopt (certificate_id) or of a CDN domain (domain_id); a CDN target otherwise resolves the domain by domain_name.

Create the module credential​

  1. Settings → Distribution → Credentials → New → Huawei Cloud.
  2. Access Key + Secret Key (+ domain_id for CDN targets). Stored envelope-encrypted.
  3. Save.

Create a Huawei Cloud target​

  1. Settings → Distribution → Targets → New. Module: Huawei Cloud.
  2. Fields:
    • Region — e.g. ap-southeast-1, cn-north-4. Must be a region the bundled SDK knows and, for ELB/WAF, the region of the object. Required at save for CDN too, but CDN calls ignore it.
    • Project ID — the region's project; shown in My Credentials → API Credentials. Ignored by CDN.
    • Credential.
    • Service scope: pick one:
      • ELB — certificate object only. CertAutoPilot creates or updates the ELB certificate; it does not touch listeners. Bind the object to your listener once in the console.
      • CDN — domain name (or domain_id). The certificate is written straight into the domain's HTTPS configuration. Note this sets the domain's HTTPS status to on: distributing to a CDN domain that currently has HTTPS disabled will enable it.
      • WAF — certificate object only, same as ELB. Bind it to the protected domain once in the console. enterprise_project_id is sent on every WAF call when set.
    • Certificate name — optional. Empty = auto-generated per certificate as cap-<token>-<domain> (token: 8-char hash derived from the certificate, stable across renewals; max 32 chars) — recommended so one target can serve multiple certificates, since ELB/WAF resolve certificates by exact name. Per certificate, the name (and ELB/WAF certificate_id adoption or the CDN domain) can be overridden from the certificate's Distributions → Overrides drawer. :::note Pure-legacy targets Targets whose remote state predates per-certificate keying re-resolve by exact name/domain lookup once per run; a manual duplicate name created in the console surfaces as a Conflict — set certificate_id in the override to disambiguate. :::
  3. Save → health check: one authenticated list call per target against the target's own sub-service — ELB certificates filtered by the name __healthcheck__, WAF certificates filtered by that name, or CDN domains filtered by that name (a CDN target without domain_id in its credential is unhealthy before any call). It proves credentials, region/project and connectivity; it does not check the certificate object or domain the target names.

Name and identity precedence​

The effective name and object for a run is resolved before the module runs, per target:

  • The override for the specific target wins; otherwise the Default (*) row contributes only its certificate_name (a certificate_id, domain_id or domain_name on the Default row is refused with 422 — one object id cannot be on many targets; a row saved before that rule is reduced to its name); otherwise the target spec; otherwise the auto name.
  • ELB/WAF name + ID are a pair. An override that sets either replaces both verbatim (the missing half becomes empty), so an ID-only override adopts that object without renaming it and a name-only override clears a spec-pinned ID. Without an override, a spec-pinned ID keeps the spec name as-is (no auto name is injected, so the pinned object is not renamed).
  • CDN domain name + ID are a pair the same way; the CDN certificate name is independent (override → spec → auto).

At deploy time ELB/WAF then resolve the object as: pinned certificate_id (verified) → ID remembered from the last run for this certificate (verified) → exact name lookup → create. Only a definitive 404 on a pinned or remembered ID falls through to the name lookup; any other error (5xx, throttle, timeout, auth) fails the target with its classified code so the next run retries — a transient error never creates a duplicate object.

Execution flow​

  1. Resolve the object (above). The ELB name lookup follows the API's paging (100 per page, up to 500 certificates); if it is cut off with no exact match the target fails with HUAWEICLOUD_CONFLICT ("name lookup incomplete") rather than creating a possible duplicate — pin certificate_id on accounts with that many same-named certificates. WAF reads one page of 100 and fails the same way when the result is incomplete.
  2. Skip when already current: the stored certificate's SHA-256 equals the chain being deployed and the configured name is empty or equal → success, unchanged. A name-only change is deliberately not skipped, so renaming still takes effect.
  3. Otherwise create the object (no match) or update it in place (certificate, key and — when configured — name). For CDN, the certificate is written into the domain's HTTPS configuration. Nothing is bound: whatever already references the ELB/WAF object picks up the new material.
  4. Remote state {certificate_id | domain_id, resolved_via} is stored per certificate on the target.
ELB and WAF need a one-time bind, or nothing serves the certificate

Because no listener or protected-domain API is called, a first ELB/WAF deployment creates a certificate object that nothing references yet. The run reports success and changed, but the VIP keeps serving the old certificate — and will keep doing so on every renewal until someone binds the object in the Huawei console.

Bind it once, then leave the name alone: renewals update that same object in place and the binding follows. Add a tls_fingerprint validation endpoint pointed at the VIP so a missing bind fails the deployment instead of passing silently. (CDN is not affected — it writes the domain configuration directly.)

Old material is replaced in place; the module never deletes an ELB/WAF object or touches cross-service references.

Rollback​

Supported via previous-version re-deploy: a rollback runs the flow above with a previous retained certificate version — the same ELB/WAF object is updated in place (its fingerprint differs, so the skip does not apply), or the CDN domain's HTTPS configuration is rewritten. Nothing is re-bound, because nothing was bound by CertAutoPilot in the first place. Eligibility, the version picker, and auto-rollback: Rollback.

Troubleshooting​

HUAWEICLOUD_AUTH — "Forbidden"​

IAM user lacks one of the actions listed under Prerequisites in the right scope (region project for ELB/WAF, Global services for CDN), or the AK/SK is wrong. Check IAM → Users → Permissions.

HUAWEICLOUD_VALIDATION — HTTP 400​

The API rejected the request content — typically an invalid PEM/key pair or a name the service refuses. Read the API message in the job log and fix the certificate or the name; the target is not retried because the same input cannot succeed.

HUAWEICLOUD_CONFLICT — ambiguous or incomplete name lookup​

More than one object carries the exact name, or the listing was cut off before an exact match could be confirmed. Pin certificate_id (ELB/WAF) or set domain_name (CDN) on the target or in a per-distribution override, or remove the duplicate names in the console.

"Resource not found in region X"​

Target resource lives in a different region than the target config says. ELB/WAF resources are regional — verify in the console. (CDN ignores the region.)

"Invalid project ID"​

Project IDs differ per region; you can't reuse one across regions. Look up the project ID for the resource's region.

See also​

Fields the setup steps do not mention​

  • Credential domain_id — part of the AK/SK credential JSON. It is required for CDN (a global service): without it every CDN deploy, health check and dry run fails with CREDENTIAL_MISSING. Save-time validation does not require it, so the gap only surfaces at deploy time.
  • Target enterprise_project_id — sent on every WAF call; set it when your WAF resources live in a non-default enterprise project.

Idempotent skip​

All three sub-services skip the upload and report success with no change when the live certificate's content hash and the resolved name both already match. A name-only change is deliberately not skipped, so renaming still takes effect. A failed read before the skip check never fails the run — it just leads to an update.