> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/secure-cdn/interface/instances/editing-a-cdn-instance.md). # Editing a CDN Instance When the *Edit* Action is selected for an instance, this page appears:
## **Name of Secure CDN Instance** A unique name for this instance, for use within the interface. ## **Hostname** Defines the domain name(s) that the instance will respond to. Admins can set multiple hostnames by entering one, selecting "Add hostname", entering the next one, etc. To connect these hostnames with the CDN, create CNAME records pointing each of them to the unique CDN host within the Link11 network. This name can be found under [Backend CNAME](/product-guides/secure-cdn/interface/instances.md#backend-cname) in the CDN Instances overview. {% hint style="info" %} Note: if you create a CNAME record without adding the Hostname to this field, the domain will not be recognized and your content will not be cached. {% endhint %} Also, if multiple Hostnames are entered, each Hostname needs to be specified in the TLS Certificate via Wildcard- or SAN-Certificate. ## **TLS** TLS (Transport Layer Security) is an encryption protocol after the X.509 certificate standard. It ensures the secure communication between a server and client. Thus requires a digital certificate which certifies the intended destination. This toggle enables TLS for the instance. For TLS to work, an encryption certificate will have to be uploaded. Note that for HTTPS, content caching can only work if the content can be decrypted. ## **Enable SNI (Server Name Indication)** With SNI enabled, the hostname is included during the TLS handshake. This is especially useful for ensuring correct certificate usage for a multi-tenant backend (i.e., a server hosting multiple sites). ## TLS Management by Link11 WAAP For customers using both Link11 WAAP and Secure CDN, an existing WAAP certificate — whether Let's Encrypt or a customer-uploaded custom certificate — can be used directly by a Secure CDN instance instead of generating and renewing a separate certificate for it. * When the WAAP certificate is fully compatible with the Secure CDN instance's hostnames, the certificate is matched and applied automatically — no extra configuration is necessary within Secure CDN. * Both Let's Encrypt certificates managed by WAAP and customer-uploaded certificates are supported. * Updates and renewals on the WAAP side are picked up automatically by Secure CDN. * If a compatible WAAP certificate is not available — e.g. due to a mismatch in covered hostnames — Secure CDN automatically falls back to generating its own Let's Encrypt certificate so the domain stays reachable. The system continues to monitor for a valid WAAP certificate and switches back once one becomes available. ## **Enable Auto-Renewal TLS Certificate** When `ON`, this allows TLS certificates be managed by the Let’s Encrypt service. {% hint style="info" %} Auto-renewal is only available if [Secure DNS](/product-guides/secure-dns.md) was purchased. {% endhint %} ## **Challenge Method** The type of challenge to use when generating or renewing TLS certificates. {% hint style="info" %} DNS challenge is only available if Secure DNS is being used, and matching DNS zones for configured hostnames are found. {% endhint %} ## **Force Let's Encrypt Certificate Renewal** Selecting this option will immediately renew the certificate using Let's Encrypt. This feature is only available when [Enable Auto-Renewal TLS Certificate](#enable-auto-renewal-tls-certificate) is `ON`. ## **Minimum TLS Protocol Support** Sets the minimum TLS protocol version that will be accepted for the customer's website. ## **TLS Security Ciphers Configuration** Lets admins select the elliptic curves used by the DDoS Proxy Instance for ECDHE and ECDSA ciphers. The standard is recommended. Clients which do not support one of the supported curves will not be able to connect to the DDoS Instance. ## **Redirect HTTP to HTTPS** Redirects insecure HTTP requests to secure HTTPS. ## **OCSP Stapling** Enables or disables OCSP Stapling for a CDN instance. The OCSP (online certificate status protocol) is an extension for TLS that enforces certificate validation which is checked over an OCSP server. OCSP can check immediately if a certificate is valid or not, which is much faster than usual techniques and as such more secure. ## **API IP ACL Limits** Specifies the IP access control lists for the CDN API, as IP ranges within a prefix (for example, `8.9.1.0/25`). IPs outside of the specified prefix(es) will not be able to connect to the CDN API. Multiple IPs can be added. Selecting the "Add Prefix" button will display an additional prefix input field. For further information, please refer to the [CDN API documentation](/using-link11/api/secure-cdn.md). ## **API Password** Sets a password for the CDN API. For further information, please refer to the [CDN API documentation](/using-link11/api/secure-cdn.md).