DocsICP FilingConsole
Documentation
Home Page Certificate Management Service Operations Management Add and pre-authorize a domain

Add and pre-authorize a domain

Updated at:
Copy as MD
Product
My Favorites

When you apply for an SSL certificate for a domain, you must manually configure a DNS record to verify domain ownership. This can be cumbersome if you manage many domains. With domain pre-authorization, you configure a CNAME record once to pre-authorize the domain. When you later apply for an SSL certificate from a supported brand, the system automatically verifies domain ownership. This simplifies the application process and reduces issuance time.

Limits

Before you start, make sure the following requirements are met so that the configuration can succeed.

  • Supported certificate brands: This feature supports only SSL certificates from DigiCert, GeoTrust, Rapid, and GlobalSign, as well as CFCA.

  • DNS provider limit: Domains that use West.cn as their DNS provider are not supported.

Step 1: Add a domain for pre-authorization

  1. Go to the Domain Pre-authorization page and click Add Domain Name.

  2. In the Add Domain Name panel, enter the Domains, select a Supported Brand and an Alert Contact, and then click OK.

Note

  • You can enter multiple domains separated by commas (,). Public IP addresses are not supported.

  • If Alibaba Cloud detects that a CNAME record has become invalid, it sends a notification to the selected contact.

Step 2: Pre-authorize the domain

  1. On the Domain Pre-Verification Management page, find the domain in the list and copy its Host Record and Record Value.

  2. Log on to your DNS provider's console or contact your DNS provider to add a CNAME record.

    Important

    Some DNS provider consoles automatically append the current domain suffix to the hostname when you add a CNAME record. Check the hostname and remove the automatically appended content. For example, if the domain added to DNS is aaa.bbb.ccc.com and the required hostname is _dnsauth.aaa.bbb, the DNS provider might change the hostname to _dnsauth.aaa.bbb.aaa.bbb.ccc.com. In this case, remove the duplicate .aaa.bbb to make sure the complete domain record is _dnsauth.aaa.bbb.ccc.com.

  3. Keep this DNS record permanently. If you delete the record, the domain can no longer use domain pre-authorization.

Step 3: Verify the pre-authorization status

  1. Return to the Domain Pre-authorization page.

  2. Find the domain. In the Actions column, click Verify. The system checks whether the CNAME record is active.

    Note

    DNS records may take some time to propagate worldwide. If verification fails, wait a few minutes and try again.

  3. After verification succeeds, the status changes to Authorized.

Note

When you apply for a certificate, select Domain Verification Method and then Manual DNS Verification. If Alibaba Cloud detects that the domain is pre-authorized, the system completes domain ownership verification directly.

Related documentation

For information about applying for a certificate, see Submit a CA application or Apply for an individual test certificate.

Previous：Operations ManagementNext：Manage contacts