Requesting a Custom Domain

Overview

When Appian Cloud environments are created, they are assigned a subdomain under the appiancloud.com (commercial regions) or appiancloud.us (US GovCloud regions) domain. However, Appian Cloud customers can request to customize the Fully Qualified Domain Names (FQDN) of their environments to provide a personalized experience to end users.

This page outlines the steps required to change the FQDN of Appian Cloud environments to a custom domain.

About Fully Qualified Domain Names (FQDN)

An FQDN consists of three parts:

• Subdomain: The first segment of the FQDN delineated by a period.
• Domain: The main part of a domain name which represents an organization or entity.
• Top-level domain (TLD): The last segment of a domain name, coming after the final period.

For example, in prod-environment.apps.mycorp.org, prod-environment is the subdomain, apps.mycorp is the domain, and org is the TLD.

Valid FQDNs

Valid domains and subdomains:

• Only use alphanumeric (A-Z, a-z, and 0-9, case-insensitive) and hyphen characters.
• Use 1 to 63 characters.
• Do not start with or end with a hyphen.

Valid TLDs:

• Only use alphanumeric (A-Z, a-z, and 0-9, case-insensitive) characters.
• Use 2 to 63 characters.

FQDN configuration

Appian Cloud environments use 3 FQDNs. By default, these are:

	Commercial regions	US GovCloud regions
Main FQDN	ENVIRONMENT_NAME.appiancloud.com	ENVIRONMENT_NAME.appiancloud.us
Static FQDN	ENVIRONMENT_NAME.appiancloud-static.com	ENVIRONMENT_NAME.appiancloud-static.us
Dynamic FQDN	ENVIRONMENT_NAME.appiancloud-dynamic.com	ENVIRONMENT_NAME.appiancloud-dynamic.us

Only the main FQDN is visible to end users.

Example

Your company domain is mycorp.org and you have an environment called production-acme currently using the appiancloud.com domain, available at production-acme.appiancloud.com. You want to customize this environment to use mycorp.org so that end users can access the environment using the FQDN production-acme.mycorp.org. Appian Cloud will take care of the two remaining FQDNs using the default domains.

Old FQDN	New FQDN
production-acme.appiancloud.com	production-acme.mycorp.org
production-acme.appiancloud-static.com	production-acme-mycorp-org.appiancloud-static.com
production-acme.appiancloud-dynamic.com	production-acme-mycorp-org.appiancloud-dynamic.com

You can also customize all 3 FQDNs, if you so choose:

Old FQDN	New FQDN
production-acme.appiancloud.com	production-acme.mycorp.org
production-acme.appiancloud-static.com	production-acme.mycorp-static.org
production-acme.appiancloud-dynamic.com	production-acme.mycorp-dynamic.org

Configuring custom domains

1. Download and fill out the Appian Cloud Domain Name Change worksheet for all environments that will be configured with a custom domain
2. Open a new support case with Appian Support to request a domain change, including the filled out worksheet.
3. Appian Support will generate a Certificate Signing Request (CSR) covering your environments and add it to the support case. If you require a key algorithm or size other than the 2048-bit RSA default, state this in the support case before the CSR is generated. See What private key algorithms and lengths are supported for custom domain certificates?.

4. Use the generated CSR to obtain a set of signed, PEM-formatted certificate files from your organization's certificate authority. Do not generate a separate key or reuse a previously provided CSR.

   Caution:  To use portals in the environment, you must use a certificate signed by a public certificate authority; privately-signed certificates are not compatible with portals.

   The certificate issued by your Certificate Authority should list the FQDNs of all your Appian environments in the Subject Alternative (SAN) field. You can only use a single certificate that covers all your Appian environments.

5. Upload the certificates to the existing support case so that Appian Support can deploy your certificate files to Appian Cloud infrastructure.
6. For public access environments, Appian Support will provide you with a DNS name of a load balancer.

7. Set up name resolution in your DNS infrastructure:

   • For public access environments, create a CNAME record in your DNS server for each environment FQDN to Appian Cloud load balancer.
     • If you wish to reverse-proxy from another service to your Appian Cloud environment(s), such as your own content delivery network (CDN) provider or Web Application Firewall (WAF), instead of pointing your CNAME records directly the the Application Cloud load balancer, you will need to point them to your third-party service, and then configure your service to proxy traffic to the Appian Cloud load balancer.
   • Consult the documentation for VPN only or dual access configurations if you are setting up your environment in one of these access options, as additional steps are required.

   Note:  For environments in US GovCloud regions, DNSSEC is enabled on the CDN for dynamic content. Ensure your DNS infrastructure supports DNSSEC validation when setting up name resolution. See DNSSEC for more information.

8. Appian Support will schedule a maintenance window to apply the new FQDN for each environment listed on the certificate.

Certificate renewal

When a certificate is close to expiration, Appian Support will notify you via support case.

1. If there is any change in the certificate field information, download and fill out the Appian Cloud Domain Name Change worksheet . Submit the completed form in the support case.
2. Appian Support will provide you with a new CSR covering all your environments.
3. Upload the signed certificate and the chain of trust in the support case.
4. Appian Support will deploy the certificate files to Appian Cloud infrastructure. This action does not require any downtime.

Frequently asked questions

Why does my Appian Cloud environment use three different domains?

The static and dynamic domains are used for background web requests to support features such as the Document Viewer Component and Component Plug-ins. These domains are needed for security purposes. Review the Post Install Configurations for more details.

Do I have to change the subdomain portion of my environment's FQDN?

You do not need to change the subdomain portion of your environment's FQDN.

What are the requirements surrounding the subdomain portion of the environment FQDN?

The subdomain portion of the environment FQDN must comply with the following requirements:

• Subdomains should be representative of your organization.
• Subdomains should be unique. That is, each subdomain must be different across environments.
• Subdomains cannot be generic or include the word "appian" in their name.

What private key algorithms and lengths are supported for custom domain certificates?

Appian Cloud supports both RSA and ECDSA (Elliptic Curve Digital Signature Algorithm) private keys for custom domain certificates:

Key algorithm	Supported key sizes or curves
RSA	2048 bits, 3072 bits, 4096 bits
ECDSA	P-256, P-384, P-521

The default is a 2048-bit RSA key. If you wish to use any other key algorithm or size, specify this requirement to Appian Support in the support case before the Certificate Signing Request (CSR) is generated.

Can I use a wildcard certificate for my domain?

Wildcard certificates are not allowed in Appian Cloud. You must use a certificate that explicitly lists the FQDNs of your Appian environments in the Subject Alternative Name (SAN) field.

Why don't I get the private key associated with my certificate signing request?

The private key for CSRs generated for Appian Cloud use are stored securely for use within Appian Cloud only. Private keys are not required to obtain issued certificate files. Key management is a critical component to keeping certificate signing trusted and secure.

Feedback