Manage Custom Domain Names in MyJFrog

The custom domain name feature allows you to provision, manage, deploy and renew a secure canonical name (CNAME) for your JPDs. For REST API documentation, see Custom Domain Name REST APIs. This means that you can allocate a custom URL to point to your JPDs. You can set up a custom domain name through MyJFrog: to learn which users can use this feature, see User Roles.

Domain names are assessed against the standards outlined in RFC1034, Section 3, and RFC1123, Section 2.1. Any domain names that do not adhere to these standards will be deemed invalid and therefore unusable.

To get started, you will need to provide a valid SSL certificate, since JFrog requires an HTTPS protocol to serve traffic over your custom domain name. After adding the certificate, you will be able to select the relevant domains under the SSL certificate and point them to the selected JPDs.

Certificate Requirements

Your SSL certificate must match the following prerequisites:

• Verify that your SSL certificate uses X.509 encryption with a private key generated using either the RSA or ECDSA algorithm. The certificate can be provided in PEM or PFX/P12 format.
• The certificate must have at least one of the following extended key usages (EKUs):

• TLS Web Client Authentication.
• TLS Web Server Authentication.
• The certificate is currently valid and must have at least 30 days left for expiration..
  • If your certificate is signed by an external authority (for example, GoDaddy), include the full certificate chain.
  • The certificate body is associated with the public key (same public key on both).
  • Encrypted (password-protected) private keys are not supported. For RSA keys:
• Minimum 2048 bits (recommended 3072+ for new keys).
• Supported formats: RSA PKCS#1, PKCS#8 ECDSA keys:.
• Minimum 256 bits (P-256 curve), maximum 521 bits (P-521 curve).
• Supported formats: SEC#1 (EC PRIVATE KEY), PKCS#8.
• Supported curves: P-256 (secp256r1), P-384 (secp384r1), P-521 (secp521r1).

You can upload your SSL certificate as a single file in .pfx or .p12 (PKCS#12) format, containing private key, certificate and chain of trust. For .pfx or .p12 files:

• Maximum file size: 256 KB
• Key types: RSA and EC (ECDSA)
• Iteration count: up to 100,000
• Password: The password used to open the file is not stored.

Create a New Custom Domain Name in MyJFrog

To create a new custom domain name:

1. In the Settings page, go to the Custom Domain Name tab, and click + Create New.

2. Specify the SSL certificate format and provide certificate details.

   • For PEM files, paste the certificate body, private key, and authentication chain, if applicable.
   • For PFX/P12 files, browse to upload the file, and specify the password.
     Click Next.

3. Select a JPD from the drop-down menu and define the domain name to associate with it (from the domains defined in the SSL certificate).

   • For each domain, you can only assign one JPD per provider’s region.
   • If you have Docker subdomains, specify whether each domain is a platform base URL or a subdomain.
   • If necessary, select Docker Subdomain with Repo Override Name to define an explicit repository name not derived from the configured domain name. This is not best practice and is not recommended.

   Note

   For Docker subdomains, your certificate must contain a subdomain for the domain you are defining. For example, artifactory.com should contain either a specific subdomain per repository name (docker-local.artifactory.com) or a wildcard (*.artifactory.com). If you use the Docker Subdomain with Repo Override Name option, you can't use a wildcard; define a domain name.

4. (Optional) Click + Define Domain to add multiple domains.

5. When you are satisfied with your selection, click Done.

6. Once the record appears on the dashboard as Active, access your DNS provider platform’s settings and add the CNAME records to your domain as follows:

   • For public domains: yourdomain.com → <server-name>.jfrog.io

   • For private endpoints: see Manage PrivateLink connections

Domain Name Examples

*.my.company.com - API to the any docker repository. The name of the repository is substituted by *.

docker.my.company.com - API to the docker repository called docker.

myoverride.my.company.com - Docker override name with a value of docker-local.

API to the docker repository called docker-local with an override domain myoverride.my.company.com.

Manage Domains in MyJFrog

To manage the domains or JPDs that are associated with a specific SSL certificate:

1. Go to Settings > Custom Domain Name. Click the option menu (three dots) next to the certificate name and select Manage Domains.
2. Add, delete, or edit the domain and associated JPDs. When you are satisfied, click Done.

Renew an SSL Certificate in MyJFrog

When you renew a certificate:

• Your new certificate must be valid for at least 30 days to process the renewal.
• Make sure the new SSL covers the defined domains under the existing SSL, or delete the redundant domains.

To renew a certificate:

1. Click Renew SSL next to the certificate status.
2. Do one of the following:
   • If you are working with a PEM file, edit your SSL certificate details.
   • If you are working with a PFX/P12 file, browse to upload a new file.
3. Select the PEM or PFX/P12 options to install a certificate with a different format. When you are done, click Next.
4. Set up the domain: your current domains can not be edited, only removed, or you can add new domains and edit the JPDs associated with your domains. When you are satisfied, click Done.

Delete an SSL Certificate in MyJFrog

When you delete a certificate, all domains associated with it are removed and all JPD links are blocked.

To delete a certificate:

1. Click the option menu (three dots) next to the certificate name and select Delete.
2. In the popup screen, type “I agree” and click Confirm.