SSL certificates-Certificate Management Service(SSL Certificate)-阿里云帮助中心

The fee for an SSL certificate depends on the certificate type, domain name type, certificate brand, or service you select. Before purchasing, review the billing details for Certificate Management Service. This topic describes the billing details for Certificate Management Service and how to manage expired SSL certificates.

Billing method

SSL certificates and related services use the subscription billing method.

Billable items

The table below lists all billable services for SSL certificates. Select the services that meet your needs.

Important

For exact prices of each billable item, see the purchase page.

Service type	Billing details
Certificate Management Service	Charges depend on the Number of Instances, Domain Type, number of domain names, Certificate Type, Certificate Brand, and Duration.
Certificate hosting service	Certificate hosting automatically renews your SSL certificate before it expires. It submits a new certificate request to extend validity and prevents service disruption caused by missed renewals. This service also supports automatic deployment. When enabled, newly issued certificates deploy automatically to supported Alibaba Cloud products. Important The hosting fee covers only the automatic renewal service. It does not include the cost of purchasing new certificates. Automatic deployment works only for cloud product deployment and multicloud deployment. It does not support Elastic Compute Service (ECS) or Simple Application Server.
Cloud product deployment service	This service deploys an issued certificate to Alibaba Cloud products that require SSL certificates, such as Anti-DDoS Proxy, WAF, and CDN. You can deploy commercial certificates for free, personal test certificates, and certificates shared between different Alibaba Cloud accounts (the accounts must belong to the same individual or enterprise user that has passed identity verification). To deploy uploaded SSL certificates, you need to Purchase Deployment Times, which costs CNY 30 per deployment and is valid for one year.
ECS deployment service	This service deploys an issued certificate to Alibaba Cloud ECS instances or Simple Application Servers. You can deploy commercial certificates for free, personal test certificates, and certificates shared across different Alibaba Cloud accounts (the accounts must belong to the same individual or enterprise user who has completed identity verification). To deploy an uploaded SSL certificate, you need to purchase deployment quota. The fee is CNY 30 per deployment, and the quota is valid for one year.
Request assistance to deploy services	This service helps resolve issues during SSL certificate use. During certificate application, experts help prepare required documents and coordinate with certificate authorities (CAs) to issue certificates as quickly as possible. If you lack experience installing or configuring certificates, experts provide remote video guidance to help troubleshoot and solve technical issues. For pricing details, see the Certificate Technical Support Service purchase page. Application assistance: Experts help issue SSL certificates during business hours (09:00–18:00, Monday to Friday). Deployment service: Experts help deploy RSA or ECC algorithm certificates during business hours (09:00–18:00, Monday to Friday). SM2 deployment service: Experts help deploy SM2 algorithm certificates during business hours (09:00–18:00, Monday to Friday). This solves complex configuration issues common with SM2 certificates. Application and deployment service: Experts assist with the full certificate lifecycle—application and deployment—during extended hours (09:00–18:00, including weekends). Note Each application assistance session supports one certificate only. Each deployment session supports deploying one certificate to one application node or one server only. If you have multiple certificates, purchase separate services for each certificate and each deployment location. For more information, see Purchase certificate application assistance and deployment services.

Validity period description

Validity periods vary by issuance date and certificate brand. For details, see Validity period changes. To minimize business impact from expiring certificates, Alibaba Cloud sends renewal reminders and provides renewal services.

Impact of Expired SSL Certificates

When a certificate expires, its validity period ends. After expiration, your website may experience the following impacts:

Users cannot access the website.
Browsers display security warnings when users visit the website.
Affects the website's search volume ranking.
Communication between visitors and the website cannot be encrypted.

Manage certificates that are about to expire

To prevent business disruption, apply for and issue a new certificate before the current certificate expires. After the new certificate is issued, install it on Alibaba Cloud services and web servers where the old certificate is installed to replace the expiring certificate.

Certificate type	Action required before expiration
Commercial certificate	Purchase a new certificate 15 days before expiration. Then submit an application, complete issuance, and install the new certificate. For renewal steps, see Renew SSL certificates. For application steps, see Apply for a certificate. For installation steps, see Deploy SSL certificates.
Hosted certificate	You do not need to renew hosted certificates because the renewal fee is included in the hosting service. The hosting service automatically submits a new certificate request before expiration. You only need to complete CA verification and choose a deployment method for the new certificate. For steps, see What to do after enabling certificate hosting.
Personal test certificate	Personal test certificates cannot be renewed. If your personal test certificate is about to expire, you can replace it with another personal test certificate, upgrade to a commercial certificate, or upgrade to an HTTPS Acceleration Gateway. For steps, see Manage expiring personal test certificates.
Third-party certificate	Before expiration, purchase a new certificate from the third-party provider. Then upload it using the Upload Certificate feature in Certificate Management Service. For upload steps, see Upload, sync, and share SSL certificates.

Expired certificate data handling

If a certificate has been expired for more than one year, Alibaba Cloud automatically deletes it. Deleted certificates cannot be recovered.

Set SSL certificate expiration reminders

Enable expiration reminders to receive timely renewal notifications and avoid business disruption from expired certificates.

Expiration reminders are enabled by default for commercial and personal test certificates. Reminders for uploaded certificates are disabled by default. Enabling them consumes one notification quota. For quota purchase steps, see Purchase notification quotas.

The following steps show how to enable or disable expiration reminders for commercial certificates:

Log in to the Certificate Management Service console.
In the navigation pane on the left, choose Certificate Management > SSL Certificate Management.
In the Commercial Certificates tab, find the target certificate. In the Actions column, click More.
In the Notification tab, enable or disable expiration reminders.

Default expiration reminder policy

Note

If you customize a notification policy, the default policy no longer applies. For customization steps, see Configure SSL certificate notifications.

Certificate type	Renewal reminder policy
Commercial certificate	Graded reminder policy
Personal test certificate	Standard reminder policy

Graded reminder policy:

For commercial certificates purchased and issued through the Certificate Management Service console, Alibaba Cloud starts sending renewal reminders 15 days before expiration. Reminders repeat every three consecutive calendar days. Each cycle sends reminders to the certificate contact, the contact management contact, and the Alibaba Cloud account contact.

Example: Certificate expiration date is 2022-12-30.

Reminder timing and recipients:
- 2022-12-01: Reminder sent to the certificate contact.
- 2022-12-02: Reminder sent to the contact management contact who receives renewal reminders.
- 2022-12-03: Reminder sent to the Alibaba Cloud account contact.
Reminder termination conditions:
- If you renew the certificate after any reminder round, the reminder process stops immediately.
- If you do not renew, reminders continue in order until the last calendar day before expiration (inclusive).
Impact of expiration:
- If you do not renew by the last calendar day before expiration, websites with this certificate will no longer provide HTTPS service after expiration.

Reminder level	Reminder recipients	Reminder cycle	Notification method	Description
Level 1	Certificate contact	Day 1 Important If you renew the certificate on this day, reminders stop. Otherwise, the next level triggers the next day.	Text message, email	The certificate contact is the person you specified when applying for the certificate. Ensure you enter correct contact information during application. For steps, see Apply for a certificate.
Level 2	administrative contact receiving renewal notifications	Day 2 Important If you renew the certificate on this day, reminders stop. Otherwise, the next level triggers the next day.	Text message, email	The contact management contact is the person you specify on the Contact Management page to receive renewal reminders. For steps, see Manage contacts.
Level 3	Alibaba Cloud account contact	Day 3 Important If you renew the certificate on this day, reminders stop. Otherwise, the next cycle starts with the certificate contact, then the contact management contact, then the Alibaba Cloud account contact.	Text message, email, internal message	The Alibaba Cloud account contact is the person you specify in the Message Center for Product Expiration Notifications. Message Center is the message management center for your Alibaba Cloud account. On the Alert Contact page in Message Center, you can modify for Pending Expiration the notification methods (Text Message, Email Address, and Internal Message) and Account Contacts.

Standard reminder policy:
Fifteen days before expiration, Certificate Management Service sends one renewal reminder to the Alibaba Cloud account contact (set in your Alibaba Cloud account), the certificate contact (set during certificate application), and the contact management contact (set on the Certificate Management Service consoleContact Management page).