Apply for an individual test certificate

SSL Certificate Management V2.0

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0.

3. Click the Individual Test Certificate (Formerly Free Certificate) tab. Find the certificate and click Apply for Certificate in the Actions column.

4. In the panel that appears, configure the following settings:

   1. Domains to Bind: Enter the domain name to bind to the certificate. You can enter only one domain name. Wildcard domain names are not supported.

      Important

      You cannot change the domain name after you submit the application. Verify the domain name before submission. To use a different domain name after submission, purchase another certificate.

   2. Domain Verification Method: Select a method to verify your control of the domain name. The following methods are supported: Automatic DNS Verification, Manual DNS Verification, and File Verification.

      • Automatic DNS Verification: This option is available if the domain name uses Alibaba Cloud DNS under the current account. If available, it is the only option displayed. Otherwise, the Manual DNS Verification and File Verification options are displayed.

      • Manual DNS Verification: Add the specified DNS record at your DNS provider. If Automatic DNS Verification is unavailable, we recommend this method. If you cannot add DNS records, select File Verification.

        Note

        If the domain name does not use Alibaba Cloud DNS, you can enable automatic DNS verification by configuring domain verification exemption. For more information, see Add and pre-authorize a domain.

      • File Verification: Upload the specified file to the web server. The file must be accessible over both HTTP and HTTPS.

        Note

        Wildcard domain names do not support File Verification. If you enter a wildcard domain name in Domains to Bind, File Verification is not displayed in Domain Verification Method.

   3. Contact: Select a certificate contact. If no contact is available, click Create Contact in the drop-down list to create one. The system notifies this contact when the certificate status changes.

   4. Location: Select the location of the certificate contact.

   5. Encryption Algorithm: Select a certificate encryption algorithm. If you have no special security requirements, select RSA2048.

   6. CSR Generation: We recommend that you select Automatic. If needed, select Manual or Select Existing CSR. For information about manually entering CSR content or uploading a locally generated CSR file, see Create or upload a CSR.

5. Click Submit. The system sends the application to the CA for review.

To change the application information, click Cancel Application in the Actions column. Change the information after you cancel the application, and then submit it again.

SSL Certificate Management (V1.0 - Discontinued)

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management (V1.0 - Discontinued).

3. Click the Individual Test Certificate (Formerly Free Certificate) tab. Find the certificate and click Apply for Certificate in the Actions column.

4. In the panel that appears, configure the following settings:

   1. Domains to Bind: Enter the domain name to bind to the certificate. You can enter only one domain name. Wildcard domain names are not supported.

      Important

      You cannot change the domain name after you submit the application. Verify the domain name before submission. To use a different domain name after submission, purchase another certificate.

   2. Domain Verification Method: Select a method to verify your control of the domain name. The following methods are supported: Automatic DNS Verification, Manual DNS Verification, and File Verification.

      • Automatic DNS Verification: This option is available if the domain name uses Alibaba Cloud DNS under the current account. If available, it is the only option displayed. Otherwise, the Manual DNS Verification and File Verification options are displayed.

      • Manual DNS Verification: Add the specified DNS record at your DNS provider. If Automatic DNS Verification is unavailable, we recommend this method. If you cannot add DNS records, select File Verification.

        Note

        If the domain name does not use Alibaba Cloud DNS, you can enable automatic DNS verification by configuring domain verification exemption. For more information, see Add and pre-authorize a domain.

      • File Verification: Upload the specified file to the web server. The file must be accessible over both HTTP and HTTPS.

        Note

        Wildcard domain names do not support File Verification. If you enter a wildcard domain name in Domains to Bind, File Verification is not displayed in Domain Verification Method.

   3. Contact: Select a certificate contact. If no contact is available, click Create Contact in the drop-down list to create one. The system notifies this contact when the certificate status changes.

   4. Location: Select the location of the certificate contact.

   5. Encryption Algorithm: Select a certificate encryption algorithm. If you have no special security requirements, select RSA2048.

   6. CSR Generation: We recommend that you select Automatic. If needed, select Manual or Select Existing CSR. For information about manually entering CSR content or uploading a locally generated CSR file, see Create or upload a CSR.

5. Click Submit. The system sends the application to the CA for review.

To change the application information, click Withdraw in the Actions column. Change the information after you withdraw the application, and then submit it again.

Automatic DNS verification

1. Wait for the system to automatically add the DNS record. This process usually takes up to 15 minutes. To check whether the record is added, click Verify in the Actions column. Then click Verify in the dialog box.

2. Wait for the CA to complete domain ownership verification. This process usually takes up to 15 minutes.

Manual DNS verification

If domain verification exemption is configured for the domain name, skip the following steps and wait for the CA to complete domain ownership verification. For more information about domain verification exemption, see Add and pre-authorize a domain.

1. Click Verify in the Actions column. Copy the DNS record from the dialog box. Then log on to your DNS provider's console and add the record. You can also contact your DNS provider to add it.

   Note

   • If both TXT and CNAME records are displayed, add only one of them. We recommend the TXT record because it provides better compatibility.

   • Some DNS providers automatically append the current domain suffix to the host record of a CNAME record. Check the complete record and remove any duplicated suffix. For example, assume that the domain name is aaa.bbb.ccc.com and the required host record is _dnsauth.aaa.bbb. The DNS provider may change the complete record to _dnsauth.aaa.bbb.aaa.bbb.ccc.com. In this case, remove the duplicated .aaa.bbb. The complete record must be _dnsauth.aaa.bbb.ccc.com.

2. Check whether DNSSEC is enabled for the domain name. Incorrect DNSSEC settings may cause domain ownership verification to fail. If DNSSEC is enabled, we recommend that you temporarily disable it. Re-enable DNSSEC after the certificate is issued. For more information, see [Announcement] DigiCert to implement DNSSEC validation for DCV and CAA checks.

3. After you add the DNS record, click Verify to check whether the record has propagated.

   Note

   DNS records may take some time to propagate.

4. After the verification succeeds, wait for the CA to complete domain ownership verification. This process usually takes up to 15 minutes.

File verification

1. Click Verify in the Actions column. In the dialog box, click verification file in the File Content column to download the verification file package.

2. Decompress the package to obtain the verification file. Do not open, edit, rename, or otherwise modify the file.

   Note

   The file is valid for three days. If it expires, download it again.

3. In the web root directory for the domain name, create the subdirectory specified in the Server Directory column. Upload the extracted file to this subdirectory.

4. After the upload is complete, click Verify to check whether the file is accessible.

5. After the verification succeeds, wait for the CA to complete domain ownership verification. This process usually takes up to 15 minutes.

   Note

   The CA first uses HTTPS over port 443 for verification. Other HTTPS ports are not supported. If the website does not have a trusted certificate, disable HTTPS and enable HTTP over port 80 to prevent verification failures. Other HTTP ports are not supported.

SSL Certificate Management V2.0

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0.

3. On the Individual Test Certificate (Formerly Free Certificate) tab, view the Status, Domain Name, and Validity Period of the certificate. The validity period is for the issued certificate, not the certificate instance subscription.

4. Find the certificate and click Details in the Actions column to view more information.

SSL Certificate Management (V1.0 - Discontinued)

1. Log on to the Certificate Management Service console.

2. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management (V1.0 - Discontinued).

3. On the Individual Test Certificate (Formerly Free Certificate) tab, view the certificate Status, Bound Domains, and Validity Period. The validity period is for the issued certificate, not the total purchased duration.

4. Click More in the Actions column to view more information.