[{"data":1,"prerenderedAt":458},["ShallowReactive",2],{"blog-multi-cloud-ssl-cert-automation":3,"blog-nav":450},{"id":4,"title":5,"body":6,"cover":434,"dateModified":434,"datePublished":435,"description":414,"draft":436,"extension":437,"meta":438,"navigation":439,"path":440,"seo":441,"sitemap":442,"stem":443,"summary":444,"tags":445,"__hash__":449},"blog\u002Fblog\u002Fmulti-cloud-ssl-cert-automation.md","多云SSL证书自动化再扩容：新增支持Cloudflare、京东云、西部数码",{"type":7,"value":8,"toc":413},"minimark",[9,14,23,30,37,59,66,70,156,162,166,169,184,187,191,203,217,232,235,238,243,246,261,264,268,271,293,296,302,306,313,331,334,338,341,345,348,352,355,359,362,365,410],[10,11,13],"h2",{"id":12},"前言为什么免费证书总要手动续签","前言：为什么免费证书总要手动续签",[15,16,17,18,22],"p",{},"原因有两个：",[19,20,21],"strong",{},"有效期太短，验证又没法自动","。通过 ACME 协议签发的免费 DV 证书（Let's Encrypt、Google Trust Services、ZeroSSL 等）有效期只有 90 天，一年至少要续签 4 次；而通配符证书（*.example.com）只能使用 DNS 验证，每次续签都要去域名解析面板手动添加 TXT 记录。域名一多，这套重复操作就成了容易遗漏的运维负担。",[15,24,25,26,29],{},"HiOFD SSL证书服务平台的解决方案是：",[19,27,28],{},"配置一份云服务商 API 凭证，平台的 DNS-01 自动验证会替你完成 TXT 记录的添加与删除","，配合自动续签与云产品部署，实现证书全生命周期的无人值守。",[15,31,32,33,36],{},"今天，我们把支持 DNS 自动验证的云服务商从 ",[19,34,35],{},"阿里云、腾讯云 2 家扩展到 5 家","，新增：",[38,39,40,47,53],"ul",{},[41,42,43,46],"li",{},[19,44,45],{},"Cloudflare","——境外域名托管首选，单一 API 令牌即可接入；",[41,48,49,52],{},[19,50,51],{},"京东云","——子用户 AccessKey 精细化授权；",[41,54,55,58],{},[19,56,57],{},"西部数码","——国内老牌域名注册商，代理商账号同样支持。",[15,60,61],{},[62,63],"img",{"alt":64,"src":65},"SSL证书平台服务商选择器，DNS自动验证支持阿里云、腾讯云、Cloudflare、京东云、西部数码五家","\u002Fimages\u002Fblog\u002Fmulti-cloud-ssl-cert-automation\u002Fprovider-picker.png",[10,67,69],{"id":68},"支持矩阵五大云服务商","支持矩阵：五大云服务商",[71,72,73,92],"table",{},[74,75,76],"thead",{},[77,78,79,83,86,89],"tr",{},[80,81,82],"th",{},"服务商",[80,84,85],{},"DNS-01 自动验证",[80,87,88],{},"证书自动部署",[80,90,91],{},"凭证形式",[93,94,95,110,123,135,145],"tbody",{},[77,96,97,101,104,107],{},[98,99,100],"td",{},"阿里云",[98,102,103],{},"✅",[98,105,106],{},"✅（已支持CDN、ESA）",[98,108,109],{},"AccessKey ID \u002F AccessKey Secret",[77,111,112,115,117,120],{},[98,113,114],{},"腾讯云",[98,116,103],{},[98,118,119],{},"即将支持",[98,121,122],{},"SecretId \u002F SecretKey",[77,124,125,127,129,132],{},[98,126,45],{},[98,128,103],{},[98,130,131],{},"—",[98,133,134],{},"API 令牌（Zone API 令牌可选）",[77,136,137,139,141,143],{},[98,138,51],{},[98,140,103],{},[98,142,131],{},[98,144,109],{},[77,146,147,149,151,153],{},[98,148,57],{},[98,150,103],{},[98,152,131],{},[98,154,155],{},"用户名 + API 连接密码",[157,158,159],"blockquote",{},[15,160,161],{},"说明：「DNS-01 自动验证」用于证书签发与续签时的域名所有权确认；「证书自动部署」指证书签发后自动推送到该服务商的云产品（如阿里云 CDN、ESA），部署能力覆盖范围以平台内实际展示为准，后续会持续扩展。",[10,163,165],{"id":164},"一份凭证两个用途","一份凭证，两个用途",[15,167,168],{},"很多用户以为云凭证只用于域名解析验证，实际上平台把一份凭证的价值用到了两处：",[170,171,172,178],"ol",{},[41,173,174,177],{},[19,175,176],{},"验证维度（云解析）","：证书申请与每次自动续签时，平台通过凭证调用服务商 DNS API 自动添加、清理 TXT 验证记录，全程无需登录服务商控制台；",[41,179,180,183],{},[19,181,182],{},"部署维度（证书部署）","：证书签发后，可自动部署到该服务商的 CDN、ESA 等云产品，续签后新证书自动替换，避免「证书续了、CDN 上还是旧证书」的遗漏事故。",[15,185,186],{},"编辑凭证时，每个服务商选项可能带有「云解析」「证书部署」能力标签，即为表示该服务商当前支持的范围。",[10,188,190],{"id":189},"关联主域名填对即自动关联凭证","关联主域名：填对即自动关联凭证",[15,192,193,194,198,199,202],{},"编辑凭证抽屉中，除了密钥字段还有一个「关联主域名」输入项（多个以逗号分隔，如 ",[195,196,197],"code",{},"example.com,test.com","），建议保存凭证时一并填写：",[19,200,201],{},"该凭证在云服务商处实际托管的主域名","。有了它，平台才能「认出」这份凭证管哪些域名，从而实现自动关联：",[38,204,205,211],{},[41,206,207,210],{},[19,208,209],{},"申请时","：证书订单若未手动选择凭证，平台会用「申请域名（含其 DNS 挑战记录名）落在凭证关联主域名之下」的规则，自动匹配你账号下「密钥验证通过 + 已填关联主域名」的凭证，命中的凭证直接用于 DNS-01 自动验证——申请流程中无需手动选择凭证；",[41,212,213,216],{},[19,214,215],{},"续签时","：续签订单同样按上述匹配规则自动关联；签发或续签成功后，凭证会写入证书记录，之后的定时自动续签与云产品自动部署直接复用，全程无需人工介入。",[15,218,219,220,223,224,227,228,231],{},"匹配规则可以直观理解为「凭证域名是申请域名所属的主域名」：凭证填 ",[195,221,222],{},"example.com","，则申请 ",[195,225,226],{},"www.example.com","、",[195,229,230],{},"*.example.com"," 等都会命中；同一份凭证托管多个主域名时，用逗号全部填上即可。",[15,233,234],{},"反之，若留空，该凭证就是「纯凭证」：密钥本身仍可用于验证与部署，但不参与自动关联，只能在申请\u002F续签流程中手动选择使用。",[10,236,237],{"id":237},"三家新增服务商接入要点",[239,240,242],"h3",{"id":241},"cloudflare一个-api-令牌就够","Cloudflare：一个 API 令牌就够",[15,244,245],{},"Cloudflare 采用单一 API 令牌认证，比国内厂商的「密钥 ID + Secret」二段结构更简单。创建步骤：",[170,247,248,251,258],{},[41,249,250],{},"登录 Cloudflare 控制台，进入「我的个人资料」→「API 令牌」；",[41,252,253,254,257],{},"点击「创建令牌」，选择 ",[19,255,256],{},"「编辑区域 DNS」模板","；",[41,259,260],{},"确认权限为「区域 - DNS - 编辑」、区域资源为「包括 - 所有区域」，创建后复制令牌填入平台即可。",[15,262,263],{},"只有当你希望把令牌范围限制到特定区域时，才需要额外配置「Zone API 令牌」（范围指定为所有区域，分配 Zone\u002FZone\u002FRead 权限）；常规场景该选填项不用填写，留空即可。",[239,265,267],{"id":266},"京东云子用户-云解析管理员权限","京东云：子用户 + 云解析管理员权限",[15,269,270],{},"推荐使用子用户 AccessKey（最小权限原则），创建步骤：",[170,272,273,276,283,290],{},[41,274,275],{},"进入京东云「访问控制」的子用户管理页，点击「创建子用户」，选择「自定义创建」；",[41,277,278,279,282],{},"访问类型勾选 ",[19,280,281],{},"「编程访问」","（启用 Access Key），确定之后就弹窗显示AccessKey ID \u002F AccessKey Secret，此时请先保存起来；",[41,284,285,286,289],{},"新增授权：权限策略搜索「云解析」，勾选 ",[19,287,288],{},"「云解析管理员权限」","（JDCloudDomainServiceAdmin）；",[41,291,292],{},"将生成的 AccessKey ID 与 AccessKey Secret 填入平台。",[15,294,295],{},"如果凭证保存时提示「未授权云解析」，通常是子用户漏了第 3 步授权，按诊断指引补齐即可。",[15,297,298],{},[62,299],{"alt":300,"src":301},"京东云凭证编辑表单，含AccessKey字段与创建步骤指引","\u002Fimages\u002Fblog\u002Fmulti-cloud-ssl-cert-automation\u002Fcredential-form-jdcloud.png",[239,303,305],{"id":304},"西部数码注意api-连接密码不是登录密码","西部数码：注意「API 连接密码」不是登录密码",[15,307,308,309,312],{},"西部数码的凭证形式是「用户名 + API 连接密码」，最容易踩的坑是：",[19,310,311],{},"API 连接密码不是会员登录密码","，需要在管理中心单独设置：",[170,314,315,318,321,328],{},[41,316,317],{},"登录西部数码官网管理中心（会员中心）；",[41,319,320],{},"打开「帐号管理」-「API接口配置」页，查看「api连接密码」；",[41,322,323,324,327],{},"同页的「允许访问的IP地址」白名单",[19,325,326],{},"建议留空","（留空即不限制来源 IP）；如果配置了白名单而平台出口 IP 不在名单内，接口会返回「ip授权失败」；",[41,329,330],{},"用户名 + API 连接密码填入平台即可。代理商账号填代理商用户名，同样支持。",[10,332,333],{"id":333},"常见问题",[239,335,337],{"id":336},"配置了云凭证后续签还需要人工干预吗","配置了云凭证后，续签还需要人工干预吗？",[15,339,340],{},"不需要。开启自动续签后，平台会在证书到期前自动完成 DNS-01 验证、签发新证书；若同时配置了云产品部署，新证书还会自动替换 CDN、ESA 上的旧证书。",[239,342,344],{"id":343},"凭证保存失败怎么排查","凭证保存失败怎么排查？",[15,346,347],{},"先看平台的“凭证信息”列：提示「密钥无效」说明凭证本身有误（复制不完整、密钥已删除等），重新生成填入；提示「未授权云解析」说明凭证正确但缺少 DNS 管理权限，按各服务商的授权指引补权限后重新保存即可。",[239,349,351],{"id":350},"通配符证书必须用-dns-验证吗","通配符证书必须用 DNS 验证吗？",[15,353,354],{},"是的。通配符证书（*.example.com）不支持 HTTP 文件验证，只能使用 DNS-01 验证。这正是云凭证自动化的价值所在——每次续签的 TXT 记录都由平台自动完成。",[239,356,358],{"id":357},"云凭证安全吗","云凭证安全吗？",[15,360,361],{},"凭证仅用于调用服务商 DNS\u002F部署 API，平台按最小权限原则设计：推荐使用子用户\u002F子账号并只授予云解析相关权限（如京东云的 JDCloudDomainServiceAdmin、Cloudflare 的「编辑区域 DNS」模板），这也是各平台的推荐做法，影响面最小。",[10,363,364],{"id":364},"相关阅读",[38,366,367,375,382,389,396,403],{},[41,368,369,374],{},[370,371,373],"a",{"href":372},"\u002Fdocs\u002Fcloud-credential","云凭证配置指南","——各服务商凭证的完整配置步骤",[41,376,377,381],{},[370,378,380],{"href":379},"\u002Fdocs\u002Fdns-validation","DNS验证详解","——DNS-01 验证的原理与常见问题",[41,383,384,388],{},[370,385,387],{"href":386},"\u002Fdocs\u002Fdeploy-cloud","部署到云产品","——CDN、ESA 证书自动部署",[41,390,391,395],{},[370,392,394],{"href":393},"\u002Fdocs\u002Fauto-renew","自动续签","——让证书永不过期",[41,397,398,402],{},[370,399,401],{"href":400},"\u002Fblog\u002Ffree-https-certificate-guide","免费HTTPS证书在线申请教程","——从申请到 Nginx 部署的完整流程",[41,404,405,409],{},[370,406,408],{"href":407},"\u002Fblog\u002Flets-encrypt-vs-google-trust-services","Let's Encrypt 与 Google Trust Services 对比","——免费证书 CA 怎么选",[15,411,412],{},"现在就可以登录平台，在「云凭证」中添加你的 Cloudflare、京东云或西部数码凭证，体验证书全自动签发与续签。",{"title":414,"searchDepth":415,"depth":416,"links":417},"",2,3,[418,419,420,421,422,427,433],{"id":12,"depth":415,"text":13},{"id":68,"depth":415,"text":69},{"id":164,"depth":415,"text":165},{"id":189,"depth":415,"text":190},{"id":237,"depth":415,"text":237,"children":423},[424,425,426],{"id":241,"depth":416,"text":242},{"id":266,"depth":416,"text":267},{"id":304,"depth":416,"text":305},{"id":333,"depth":415,"text":333,"children":428},[429,430,431,432],{"id":336,"depth":416,"text":337},{"id":343,"depth":416,"text":344},{"id":350,"depth":416,"text":351},{"id":357,"depth":416,"text":358},{"id":364,"depth":415,"text":364},null,"2026-09-29",false,"md",{},true,"\u002Fblog\u002Fmulti-cloud-ssl-cert-automation",{"title":5,"description":414},{"loc":440},"blog\u002Fmulti-cloud-ssl-cert-automation","HiOFD SSL证书服务平台的DNS自动验证服务商从阿里云、腾讯云扩展至五家，新增Cloudflare、京东云、西部数码支持；一份云凭证即可同时完成证书DNS-01验证与CDN、ESA等云产品的自动部署续签。",[446,447,448,88],"SSL证书自动化","DNS验证","多云支持","66ZJi1KTcC3IWzxXLExbW7_KMxLSp4UjW-Ig4lQCM9s",[451,452,455],{"path":440,"title":5,"datePublished":435},{"path":407,"title":453,"datePublished":454},"Let's Encrypt vs Google Trust Services：两大免费SSL证书如何选择","2026-09-10",{"path":400,"title":456,"datePublished":457},"免费HTTPS证书在线申请教程：从申请到Nginx部署","2026-07-26",1790676773488]