From ba9121b402afb3210e552c950b90fa4fcdc3cbcf Mon Sep 17 00:00:00 2001 From: john-lauro Date: Thu, 18 Jun 2026 11:24:15 -0400 Subject: [PATCH 1/4] docs(EDRT-9031): add GCDN with Bot Protection custom certificate documentation - Add a GCDN with Bot Protection tab covering custom and wildcard certs - Document the LE-first then custom-cert flow and the CAA-blocked path - Note CDN-specific DNS values are obtained via CSE - Remove outdated alternative-CDN downgrade reference --- source/content/custom-certificates.md | 41 +++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/source/content/custom-certificates.md b/source/content/custom-certificates.md index 48f77295d8..93143ffaff 100644 --- a/source/content/custom-certificates.md +++ b/source/content/custom-certificates.md @@ -2,7 +2,7 @@ title: "Custom Certificates on Pantheon Advanced and Global CDN" description: For contract customers who require dedicated, custom TLS certificates. tags: [cdn, https, professional-services] -reviewed: "2022-12-07" +reviewed: "2026-06-18" contenttype: [doc] innav: [true] categories: [security] @@ -43,6 +43,35 @@ Allow two business days for your Account Team to load the certificate. + + +GCDN with Bot Protection supports custom certificates, including **wildcard certificates** (for example, `*.example.com`) that cover multiple subdomains. + +### Before You Begin + +Your domain must already be added to your environment and serving traffic through GCDN with Bot Protection before a custom certificate can be applied. Domains are initially secured with an automatically issued Let's Encrypt certificate; the custom certificate replaces it. + +If your domain cannot use Let's Encrypt (for example, because of CAA restrictions), your Customer Success Engineer (CSE) can apply the custom certificate directly. + +### Send the CSR to Your CA + +[Contact Pantheon Support](/guides/support/contact-support/) to request a Certificate Signing Request (CSR). Pantheon generates the CSR and stores the private key securely — the private key is never shared or exported. + +Pass the CSR to your **Certificate Authority** (CA) to obtain your signed certificate. For a wildcard certificate, request a wildcard certificate from your CA using the CSR Pantheon provides. + +Return the signed certificate, along with any intermediate certificates, to Pantheon Support. Allow two business days for your Account Team to apply the certificate. + +#### CSR Notes + +- You must use a Pantheon-generated CSR. This is a hard requirement. If you already have a certificate, it will need to be re-keyed to match the CSR we provide. + +- Your CA must accept the CSR Pantheon provides. If your CA fails to accept our CSR, you will not be able to use it to generate a certificate. + +### DNS Records + +DNS records for GCDN with Bot Protection differ from the Global CDN. Work with your Customer Success Engineer (CSE) to obtain the correct DNS values (`CNAME` or `A`/`AAAA` records) for your domains. + + @@ -107,6 +136,10 @@ To help generate CAA records, please see the free online tool: + With GCDN with Bot Protection, domains are initially validated and secured with a Let's Encrypt certificate before the custom certificate is applied. After your custom certificate is in place, add CAA records to prevent Let's Encrypt from re-issuing certificates for those domains. + + #### Issue: A Let's Encrypt Certificate is being served instead of the custom certificate If a Let's Encrypt Certificate is deployed before the CAA record preventing it, [contact Pantheon Support](/guides/support/contact-support/) for assistance. Please allow at least 3 business days for Pantheon to resolve the Let's Encrypt Certificate. @@ -115,6 +148,10 @@ If a Let's Encrypt Certificate is deployed before the CAA record preventing it, Update `A` and `AAAA` records provided by Pantheon Support. Note that even for subdomains, `A` and `AAAA` records are required. Do not use a `CNAME` record. + + DNS records differ for GCDN with Bot Protection. Work with your Customer Success Engineer (CSE) to obtain the correct DNS values (`CNAME` or `A`/`AAAA` records) for your domains. + + ## Renew or Replace a Custom Certificate About 45 days before your custom certificate expires, Pantheon will open a ticket with your team with a new CSR. You can send that CSR to the Certificate Authority to generate new certificates (as described above for bringing a custom certificate). @@ -129,7 +166,7 @@ It may take up to two business days to process the request. ## Remove a Custom Certificate -All sites require an encryption certificate. To downgrade a site that uses a custom certificate, [modify the site's CAA records](/custom-certificates#disable-lets-encrypt-with-caa-records) to re-enable Pantheon’s [Global CDN](/guides/global-cdn/https) Let's Encrypt to issue certificates. Alternatively, you can use another CDN like [Cloudflare](/cloudflare). +All sites require an encryption certificate. To downgrade a site that uses a custom certificate, [modify the site's CAA records](/custom-certificates#disable-lets-encrypt-with-caa-records) to re-enable Pantheon’s [Global CDN](/guides/global-cdn/https) Let's Encrypt to issue certificates. ## Frequently Asked Questions From 37d3a38c1903547b01a7cc735f4e593c1ec75bd1 Mon Sep 17 00:00:00 2001 From: john-lauro Date: Thu, 18 Jun 2026 12:12:01 -0400 Subject: [PATCH 2/4] docs(EDRT-9031): tighten Bot Protection cert steps and fix grammar - Remove redundant CSR-to-CA instruction in the Bot Protection tab - Trim wordiness in Before You Begin and CAA guidance - Fix broken sentence in Test Before Going Live section --- src/source/content/custom-certificates.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/source/content/custom-certificates.md b/src/source/content/custom-certificates.md index 4ef87cd3f6..80fcfbd3d3 100644 --- a/src/source/content/custom-certificates.md +++ b/src/source/content/custom-certificates.md @@ -51,17 +51,17 @@ GCDN with Bot Protection supports custom certificates, including **wildcard cert ### Before You Begin -Your domain must already be added to your environment and serving traffic through GCDN with Bot Protection before a custom certificate can be applied. Domains are initially secured with an automatically issued Let's Encrypt certificate; the custom certificate replaces it. +Your domain must already be added to your environment and serving traffic through GCDN with Bot Protection. Domains are initially secured with an automatically issued Let's Encrypt certificate, which your custom certificate then replaces. -If your domain cannot use Let's Encrypt (for example, because of CAA restrictions), your Customer Success Engineer (CSE) can apply the custom certificate directly. +If your CAA records block Let's Encrypt from issuing that initial certificate, work with your Customer Success Engineer (CSE) to permit Let's Encrypt or temporarily lift the restriction. ### Send the CSR to Your CA -[Contact Pantheon Support](/guides/support/contact-support/) to request a Certificate Signing Request (CSR). Pantheon generates the CSR and stores the private key securely — the private key is never shared or exported. +[Contact Pantheon Support](/guides/support/contact-support/) to request a Certificate Signing Request (CSR). Pantheon generates the CSR and keeps the private key secure — it is never shared or exported. -Pass the CSR to your **Certificate Authority** (CA) to obtain your signed certificate. For a wildcard certificate, request a wildcard certificate from your CA using the CSR Pantheon provides. +Send the CSR to your **Certificate Authority** (CA) to obtain your signed certificate. For wildcard coverage, request a wildcard certificate from your CA. -Return the signed certificate, along with any intermediate certificates, to Pantheon Support. Allow two business days for your Account Team to apply the certificate. +Return the signed certificate and any intermediate certificates to Pantheon Support. Allow two business days for your Account Team to apply it. #### CSR Notes @@ -123,7 +123,7 @@ Test production domain(s) before updating DNS by overriding DNS on your local co -For non-production domains, test on any environment (Dev, Test, Live or Multidev), just make sure to include the non-production domains on your certificate. We are happy to provide a new CSR if your original CSR and certificate did not initially non-production domains. +For non-production domains, test on any environment (Dev, Test, Live or Multidev), just make sure to include the non-production domains on your certificate. We are happy to provide a new CSR if your original CSR and certificate did not initially include non-production domains. ### Disable Let's Encrypt with CAA Records From 0c9906eb1c72e807bf0031a34e6b13812c871d15 Mon Sep 17 00:00:00 2001 From: john-lauro Date: Tue, 30 Jun 2026 10:48:31 -0400 Subject: [PATCH 3/4] docs(EDRT-9031): clarify wildcard subdomain, CAA-blocked, and renewal CSR-reuse for Bot Protection --- src/source/content/custom-certificates.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/source/content/custom-certificates.md b/src/source/content/custom-certificates.md index 80fcfbd3d3..4a2dbc5e38 100644 --- a/src/source/content/custom-certificates.md +++ b/src/source/content/custom-certificates.md @@ -2,7 +2,7 @@ title: "Custom Certificates on Pantheon Advanced and Global CDN" description: For contract customers who require dedicated, custom TLS certificates. tags: [cdn, https, professional-services] -reviewed: "2026-06-18" +reviewed: "2026-06-30" contenttype: [doc] innav: [true] categories: [security] @@ -53,7 +53,9 @@ GCDN with Bot Protection supports custom certificates, including **wildcard cert Your domain must already be added to your environment and serving traffic through GCDN with Bot Protection. Domains are initially secured with an automatically issued Let's Encrypt certificate, which your custom certificate then replaces. -If your CAA records block Let's Encrypt from issuing that initial certificate, work with your Customer Success Engineer (CSE) to permit Let's Encrypt or temporarily lift the restriction. +For wildcard certificates, each subdomain you want the certificate to serve must still be added to your environment as a domain — a wildcard certificate does not automatically apply to subdomains that have not been added. + +If your CAA records block Let's Encrypt from issuing that initial certificate, work with your Customer Success Engineer (CSE) to either temporarily permit Let's Encrypt, or have the CSE apply your custom certificate directly. ### Send the CSR to Your CA @@ -158,6 +160,10 @@ Update `A` and `AAAA` records provided by Pantheon Support. Note that even for s About 45 days before your custom certificate expires, Pantheon will open a ticket with your team with a new CSR. You can send that CSR to the Certificate Authority to generate new certificates (as described above for bringing a custom certificate). + + For GCDN with Bot Protection, Pantheon retains your private key and original CSR, so renewals reuse the same CSR rather than issuing a new one. When Pantheon opens your renewal ticket, request a new signed certificate from your CA using the existing CSR and return it to Pantheon Support. + + To update a certificate with additional domains, [contact Pantheon Support](/guides/support/contact-support/) with the following details: - The current common name (CN) and any SANs From 0d844c3a2d901367a74c423ad5073f321ebdbf61 Mon Sep 17 00:00:00 2001 From: hckia Date: Tue, 21 Jul 2026 08:32:20 -0700 Subject: [PATCH 4/4] Added a one-liner about fallback to managed cert on expiration attempt --- src/source/content/custom-certificates.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/source/content/custom-certificates.md b/src/source/content/custom-certificates.md index 4a2dbc5e38..3d18dd6073 100644 --- a/src/source/content/custom-certificates.md +++ b/src/source/content/custom-certificates.md @@ -172,6 +172,10 @@ To update a certificate with additional domains, [contact Pantheon Support](/gui It may take up to two business days to process the request. +## Custom Certificate Expiry + +If your custom certificate expires before a renewal is applied, the system will attempt to revert to a managed Let's Encrypt certificate until a new custom certificate is uploaded. In this scenario, your site remains accessible — only the custom certificate is temporarily replaced. + ## Remove a Custom Certificate All sites require an encryption certificate. To downgrade a site that uses a custom certificate, [modify the site's CAA records](/custom-certificates#disable-lets-encrypt-with-caa-records) to re-enable Pantheon’s [Global CDN](/guides/global-cdn/https) Let's Encrypt to issue certificates.