Billing Overview of SSL Certificates

Billing method

SSL certificates and related services are prepaid. You pay for the selected subscription duration in a single payment when you place the order. You are no longer charged after the subscription expires.

When you buy or renew a certificate, you pay for the certificate. You must also select one certificate automation service edition for the certificate: Basic Edition, Standard Edition, Professional Edition, or Ultimate Edition. The purchase and activation are completed in a single process. For the billing of each edition, see Certificate automation service billing.

Certificate types and billing

SSL certificates are classified into commercial certificates and individual test certificates. The fees and purchase rules differ significantly between the two types.

Before you place an order, make sure that the certificate type you select meets your business requirements. For more information, see SSL certificate selection.

Certificate automation service billing

Management capabilities such as public domain name monitoring, auto-managed certificate, server deployment, cloud service deployment, and custom notifications are consolidated into the certificate automation service. These capabilities are packaged into service editions that you select when you buy a certificate. The service duration is the same as the subscription duration of the certificate. When the certificate subscription expires, the associated services expire at the same time. The following table describes the supported certificate types, the capabilities, and the included quotas of each service edition.

Existing V2.0 certificates are associated with a service edition based on the following rules: an Individual Test Certificate (Formerly Free Certificate) is automatically associated with the Basic Edition service, and its existing benefits remain unchanged; a Commercial Certificates is automatically associated with the Standard Edition service, and its existing benefits remain unchanged. When you renew such a certificate, you are charged based on the Standard Edition service.

V1.0 certificates cannot be associated with a certificate automation service. For a V1.0 certificate, you can buy the auto-managed certificate, public domain name monitoring, and custom notification services separately. If you need a service edition, buy a V2.0 certificate. For more information, see Purchase a commercial certificate.

Value-added services that you purchased separately remain available. If a certificate instance is associated with a certificate automation service, the quotas of the certificate automation service are consumed first. The public domain name monitoring capability that is included in a certificate automation service has its own configuration page, which is different from the configuration page of the monitoring service that you purchase separately. For more information, see Purchase and enable public domain name monitoring.

Upgrade and additional quota billing

You can change a certificate automation service in two ways: upgrade the service edition or purchase additional quotas. The two ways are billed differently. A service edition can only be upgraded. Downgrades are not supported.

• Upgrade the service edition: You can upgrade to a higher service edition within the validity period of the certificate. You pay the price difference between the two editions based on the remaining days. After the upgrade, the service duration remains the same as the subscription duration of the certificate.

• Purchase additional quotas: You can purchase additional domain name quotas for public domain name monitoring and additional node quotas for server deployment at any time. The unit price is the same as the price at the time of purchase. The fee is not prorated based on the remaining days. In other words, the fee does not depend on the remaining subscription duration.

After you buy a certificate and the first certificate is issued, you can upgrade the service of a specific certificate instance on the SSL Certificate Management V2.0 page.

Expiration

After an SSL certificate subscription expires, the renewal entry is no longer provided. You can still view and download the certificates that have been issued. An issued certificate remains available until the certificate itself expires. However, no new certificate is issued after the subscription ends.

You pay for the service duration of the certificate, which is the subscription duration. You do not pay for the validity period of a single certificate. Certificate industry policies limit the maximum validity period of a single public certificate. If the subscription duration is longer than this limit, multiple certificates are issued in sequence during the subscription to cover the entire subscription duration. The total subscription duration remains the same, and no fee is charged for the new certificates that are issued during the subscription. You must apply for the next certificate when the current one is about to expire. You cannot apply for it in advance. Updating a certificate is the same as applying for a certificate for the first time. For more information, see Submit a CA application.

Renewal

Renewal prices are affected by supplier price adjustments and changes to promotions. The renewal price is not guaranteed to be the same as the price of your first purchase. The price displayed in the console at the time of renewal applies.

Billing method

The auto-managed certificate service is prepaid. You are charged based on the number of auto-managed certificate quotas. The fee does not depend on the purchase duration. One quota covers one automatic certificate update during the subscription period. In an automatic update, the system applies for a new certificate and deploys the new certificate to the associated cloud services. For information about why a certificate must be updated during a subscription, see Expiration.

No additional fee is charged for updating a certificate during a subscription. If you apply for a new certificate manually, no quota is consumed and no fee is charged. The fee for auto-managed certificate quotas covers only the automation: the system completes the application, validation, and deployment for you.

The price is subject to the auto-managed certificate service buy page.

Billing rules

You can obtain the auto-managed certificate capability in either of the following ways. The two ways are mutually exclusive. You need only one of them to enable the capability.

• Select a service edition when you buy a certificate: Select the Professional Edition or Ultimate Edition of the certificate automation service. These editions include unlimited auto-managed certificate updates. You do not need to buy quotas separately. For the capabilities of each service edition, see Certificate automation service billing.

• Buy auto-managed certificate quotas separately: For a V2.0 certificate instance that is not associated with the Professional Edition or a higher edition, and for a V1.0 certificate, buy quotas on the auto-managed certificate service buy page.

Expiration

Auto-managed certificate quotas do not expire. After you buy quotas, you can use them for any certificate in your account that needs automatic management. After a certificate expires, automatic management is no longer triggered for that certificate. You must apply for and deploy a certificate manually.

Billing method

The custom notification service is prepaid. You are charged based on the number of certificates for which you can enable custom notifications. The fee does not depend on the number of notifications that are sent.

The purchased quantity is the number of certificates for which custom notifications can be enabled at the same time. For example, if you buy one, you can configure custom notifications for only one V1.0 certificate or one V2.0 certificate subscription instance. To configure custom notifications for more certificates or subscription instances, buy the required quantity. You can buy the service by unit or by resource plan. The larger the resource plan, the lower the unit price.

The price is subject to the custom notification service buy page.

Billing rules

The scope of charged notifications varies with the certificate type. Before you place an order, check whether you need to buy the service for your certificates.

Expiration

The service duration of custom notifications is the same as the subscription duration of the bound SSL certificate. You do not need to renew the service separately. After the certificate subscription expires, custom notifications for that certificate stop at the same time.

Billing method

The public domain name monitoring service is prepaid and is sold on an annual basis.

You are charged based on the number of quotas. One quota covers the monitoring of one public domain name for one year. To monitor more domain names, buy the required number of quotas.

The price is subject to the public domain name monitoring buy page.

Expiration

After the monitoring service expires, Alibaba Cloud stops monitoring the HTTPS status of the domain name. The remaining monitoring days of the domain name monitoring service instance change to 0.

The renewal entry is available only within 30 calendar days before the service expires. Renewal is not supported after the service expires. To continue using the service, buy new domain name quotas and enable monitoring for the domain name again.

Renewal

If you buy the public domain name monitoring service separately, no renewal is required. Each quota includes one year of monitoring for one domain name. After a quota expires, buy a new quota.

Billing method

The cloud service deployment service is prepaid. You are charged based on the number of cloud service instances. The fee does not depend on the purchase duration. Deployment quotas do not expire. They remain valid in your account, and no renewal is required.

One quota covers the deployment to one cloud service resource. If you need to deploy certificates to many cloud service resources, buy the required number of quotas.

The price is subject to the cloud service deployment buy page.

Billing rules

Deployment quotas are consumed only when you deploy an uploaded third-party certificate to a cloud service. The following rules apply.

• Billed by cloud service instance: One quota is consumed when a certificate is deployed to a cloud service instance for the first time. Subsequent deployments to the same instance do not consume quotas.

• Certificates that do not consume quotas: Certificates that you buy from Alibaba Cloud (including commercial certificates and individual test certificates) and certificates that are shared between Alibaba Cloud accounts under the same verified entity do not consume deployment quotas. You do not need to buy quotas for such certificates.

• Failures and rollbacks: If a deployment fails, the corresponding quota is returned. If a deployment task is rolled back, the consumed quota is not returned.

Free services

Online consultation with experts is free of charge. It is available to all users and does not consume the units of paid expert services. For the consultation channels and service scope, see One-on-one expert service.

Paid services

Paid services are prepaid. You are charged based on the service type and the quantity that you buy. One application assistance service covers one certificate. One deployment service covers the deployment of one certificate to one application node or one server. If you have multiple certificates or multiple deployment locations, buy the corresponding number of units.

The following service types are available: SSL certificate application assistance, SSL certificate deployment, SSL certificate deployment (SM), and SSL certificate application assistance and deployment. The unit price, service hours, and supported certificate algorithms vary with the service type. Check on the buy page whether the type you select meets your requirements.

The price is subject to the SSL certificate expert services buy page.

The expert service units that you buy do not expire. They remain valid in your account, and no renewal is required.

Why does the price of an SSL certificate change? Why is it higher than before or different from my previous order?

A price change, or a difference from a previous order, is usually caused by one of the following reasons:

• Different promotions: Your previous purchase may have included a first-purchase discount or a limited-time discount. The current price may be the list price, or the previous promotion may have ended.

• Official price adjustment: The prices of some certificate brands, such as DigiCert and CFCA, change with the pricing strategies of the CAs. Alibaba Cloud publishes an announcement before a price adjustment takes effect. For more information, see the official price adjustment announcements.

• Different configurations: Before you compare prices, make sure that the Certificate Brand, certificate type (DV, OV, or EV), and Domain Type (single domain name or wildcard) are exactly the same as in your previous order. Prices vary greatly with the configuration.

• First-purchase discount and renewal price: A newly registered Alibaba Cloud account may be eligible for a first-purchase discount when it buys an SSL certificate for the first time. Subsequent purchases are not eligible. Similarly, if you received a discount on your first purchase, the renewal may be charged at the current list price. As a result, the renewal price is not necessarily the same as the first-purchase price.

To learn the exact reason for a price change or to request a discount, contact your account manager or call 95187 and then press 1.

Where can I view the order history and bills of SSL certificates?

Orders and bills of SSL certificates are managed in the Billing Management console. In the Expenses and Costs console, go to the order management page and search by "SSL Certificate" or by order number. You can also go to the order and refund management page in the Certificate Management Service console and jump to the corresponding bill.

Which SSL certificate services are free? Which services are charged?

Free services:

• Individual Test Certificate (Free): Each verified entity can apply for up to 20 individual test certificates (DV) free of charge per calendar year. All Alibaba Cloud accounts under the same verified entity share this quota. Unused quotas are not carried over to the next year.

• Certificate upload: Uploading a third-party certificate to an Alibaba Cloud service, such as ALB or WAF, is free of charge.

• Deploying certificates to cloud services: Certificates that you buy from Alibaba Cloud (including commercial certificates and individual test certificates) and certificates that are shared between Alibaba Cloud accounts under the same verified entity do not consume deployment quotas. Deploying a certificate to a cloud server or an on-premises server consumes a node quota. Node quotas are provided only with the Professional Edition and higher editions of the certificate automation service. For more information, see Certificate automation service billing.

Paid services:

How do I get an invoice for an SSL certificate?

• When you can apply: You can apply for an invoice only after you complete the payment for a purchase or a renewal. You cannot apply for an invoice in advance if the renewal entry is not available or the order is unpaid.

• Invoice title: The invoice title must match the verified entity of your Alibaba Cloud account. If your account uses individual verification, an individual invoice title is used by default. To use a corporate invoice title, change the account to corporate verification, or submit an application for a corporate title as required by the Billing Management console.

For information about how to apply for and download an invoice, see the invoice management documentation of the Billing Management console.

Why is the price displayed in the console different from the amount I actually pay?

A difference between the price displayed in the console and the amount that you actually pay is usually caused by one of the following reasons:

Reason 1: An unpaid order exists.

If you created an SSL certificate order but did not pay for it, that order may include the promotional price at the time it was created. A new order may use the current price, which does not include the previous discount.

An unpaid order keeps the promotional price from the time the order was created. A new order is charged at the current price. After the original order is canceled, the first-purchase discount and limited-time discounts are not restored. To compare prices, check whether you have unpaid orders in the order list of the Billing Management console.

Reason 2: The promotion has ended.

If an unpaid order is canceled, the original first-purchase discount or limited-time discount may have expired when you buy again. As a result, the price returns to the list price.