When you purchase a certificate, the fees you need to pay vary depending on the certificate type, domain type, SSL certificate brand, or service you select. Before purchasing, we recommend that you understand the billing details of the product. This topic describes the billing details of SSL certificates and how to handle expired SSL certificates.
Billing method
SSL certificates and their related services use a prepaid billing model.
Billing items
The following table lists all billable services related to SSL certificates. Choose the services you need based on your actual requirements.
For the specific prices of different billing items, refer to the prices displayed on the buy page.
Service Type | Billing Description |
SSL Certificate Management Service | The certificate purchase fee is billed based on the number of certificates, domain type, certificate type, certificate brand, and subscription duration. |
Certificate Hosting Service | Certificate hosting is a service that ensures automatic renewal of SSL certificates before they expire. When your certificate is about to expire, the hosting service helps you automatically apply for a new certificate to extend the validity period, avoiding situations where you forget to renew and cannot obtain a new certificate in time. Certificate hosting also provides automatic deployment capabilities. When automatic deployment is enabled, the new certificate is automatically deployed to the corresponding cloud products after issuance. Important
|
Cloud Product Deployment Service | Cloud product deployment service refers to the fee for one-click deployment of issued certificates to Alibaba Cloud products that require certificates (such as Anti-DDoS Pro, WAF, CDN, etc.).
|
Cloud Server Deployment Service | Cloud server deployment service refers to the fee for one-click deployment of issued certificates to Alibaba Cloud servers (Simple Application Server or Elastic Compute Service instances).
|
Application Assistance and Deployment Service | Application assistance and deployment services help you resolve various issues when using SSL certificates. When applying for a certificate, the service assists you in organizing application materials and proactively coordinates with the CA issuer to ensure the certificate is issued in the shortest time. If you lack the capability to install or configure certificates, experts can provide video remote guidance to help you quickly identify and resolve technical issues. For billing details of application assistance and deployment services, refer to the certificate technical support service purchase page.
Note One application assistance service supports only one certificate, and one deployment service supports deploying one certificate to one application node or server. If you have multiple certificates, you need to determine the number of services to purchase based on the number of certificates and the number of locations where certificates need to be deployed. For more information, refer to Purchase certificate application assistance and deployment services. |
Price query and estimation
The price of an SSL certificate is affected by the certificate brand, certificate type (DV/OV/EV), domain type (single domain/wildcard/multi-domain), number of domains, and subscription duration. Different configuration combinations have different prices. Refer to the buy page for specific prices.
Check real-time prices
Log on to the SSL Certificate buy page, select the desired certificate brand, certificate type, domain type, and subscription duration. The real-time price for the corresponding configuration is displayed on the right side of the page.
Estimate renewal price
The renewal entry for an SSL certificate opens only 15 days before the certificate expires. If you need to estimate the renewal price before the renewal window opens, you can use the following method:
Log on to the SSL Certificate buy page.
Select the same configuration as your current certificate, including the certificate brand, certificate type (DV/OV/EV), domain type, number of domains, and subscription duration.
The new purchase price displayed on the page can be used as a reference for the renewal price estimation.
The actual renewal price is subject to the price displayed on the buy page at the time of renewal. The estimated price is for reference only.
The renewal price may not be the same as your historical purchase price. Prices may change due to CA institution price adjustments or the end of promotional offers.
If you need a formal quotation, we recommend contacting your business manager.
Price fluctuation notice
SSL certificate prices may change due to the following reasons:
CA institution price adjustment: Certificate prices are related to the pricing strategies of upstream CA institutions (such as DigiCert, CFCA, etc.). When a CA institution adjusts its prices, Alibaba Cloud will correspondingly adjust the certificate selling price and publish a price adjustment announcement in advance.
Promotional offer changes: After first-purchase discounts, limited-time discounts, and other promotional offers end, prices will return to the list price.
Renewal price may differ from first-purchase price: If you enjoyed a discount on your first purchase, the renewal may be charged at the current list price.
For the latest price change information, pay attention to official price adjustment announcements.
Subscription mode
SSL certificates use a subscription service model. After purchase, certificate quotas are provided according to the subscription duration. Understanding the following rules helps you plan your certificate purchase and usage reasonably.
Validity period calculation start point
The subscription validity period of an SSL certificate is calculated from the purchase date (the time when payment is completed). The issuance validity period is calculated from the certificate issuance date and expires after the validity period ends. Issued certificates are not affected by the subscription validity period.
Apply for certificate issuance promptly after purchase. If you do not apply for issuance within the subscription period after purchase, the subscription duration continues to be consumed, which may result in the certificate quota expiring before use. Purchase certificates as needed; advance stockpiling is not recommended.
Multi-year subscription issuance rules
Due to industry standard requirements, a single SSL certificate has a maximum validity period of approximately half a year. When purchasing a multi-year subscription, the system issues certificates in batches during the subscription period:
Subscription Duration | Issuance Method |
1 year | If automatic hosting is enabled, the system automatically applies for and issues the second certificate before the first certificate expires. If automatic hosting is not enabled, you need to apply for and issue the second certificate yourself before the first certificate expires. |
2 years | |
3 years |
Note:
A single certificate with a multi-year validity period cannot be issued at once. Each issued certificate has a validity period of approximately half a year (subject to industry policy changes at any time).
If the page displays "Multi-year purchase is currently not supported" or "Automatic hosting is currently not supported", it means the current certificate type or brand supports only half-year issuance. You need to manually renew and apply for a new certificate before each certificate expires.
SSL certificate validity period
The validity period of different certificates varies due to factors such as issuance time and brand. For details, refer to the Validity period change summary. To reduce the impact of certificate expiration on website operations, Alibaba Cloud sends renewal reminders before the certificate expires and provides certificate renewal services.
Impact of SSL certificate expiration
SSL certificate expiration refers to when an SSL certificate exceeds its validity period. After an SSL certificate expires, it may cause the following impacts on your website:
Your website cannot be accessed.
Users see a security warning when visiting the website through a browser.
Your website's search engine ranking may be affected.
Communication between visitors and the website cannot be encrypted.
Handling an expiring SSL certificate
To avoid certificate expiration affecting your website operations, you need to apply for and issue a new certificate before the current certificate expires. After the new certificate is issued, you need to reinstall it in the Alibaba Cloud products and web servers where the old certificate was installed, replacing the soon-to-expire old certificate.
Certificate Type | Actions Required Before Expiration |
Commercial Certificate | When the certificate is about to expire (15 days before expiration), purchase a new certificate through the renewal purchase entry, and reapply for, issue, and install the certificate.
|
Hosted Certificate | The cost of the certificate used for renewal has already been paid during certificate hosting, so you do not need to pay for hosted certificate renewal. The hosting service automatically submits a certificate application for the new certificate when it is about to expire. You only need to cooperate with the CA center for identity verification and select an appropriate deployment method for the new certificate. For specific operations, refer to What to do after enabling certificate hosting. |
Individual Test Certificate | Individual test certificates do not support renewal. If your individual test certificate is about to expire, you can choose to continue using the individual test certificate to replace the original certificate, upgrade to a commercial certificate, or upgrade to an HTTPS acceleration gateway. |
Third-party Certificate | Before the certificate expires, you need to purchase a certificate from the third-party platform and re-upload and deploy it through the upload certificate feature. For how to upload a certificate, refer to Upload, sync, and share SSL certificates. |
SSL certificate expired data handling
If an SSL certificate has been expired for more than one year, Alibaba Cloud will automatically delete the certificate and it cannot be recovered.
FAQ
Why is the SSL certificate price I see more expensive than before or inconsistent with my historical order?
If the SSL certificate price is inconsistent with your historical order, it is usually due to the following reasons:
Promotional offer differences: You may have enjoyed a first-purchase discount or limited-time discount (such as 20% or 25% off) when you previously purchased. The current price may be the list price or the original promotional offer has ended.
Official price adjustment: The prices of some certificate brands (such as DigiCert, CFCA, etc.) are adjusted according to the pricing strategies of CA institutions. Alibaba Cloud publishes price adjustment announcements before making price changes. Refer to official price adjustment announcements for details.
Configuration differences: Before comparing prices, confirm that the certificate brand, certificate type (DV/OV/EV), and domain type (single domain/wildcard) you currently selected are exactly the same as those in your historical order. The price difference between different configurations can be significant.
First-purchase eligibility: A newly registered Alibaba Cloud account may enjoy a first-purchase discount when buying an SSL certificate for the first time. Subsequent purchases will not be eligible for this discount.
For specific reasons for price changes or to apply for a discounted plan, we recommend contacting your business manager or submitting a support ticket.
How do I view the historical order amount and billing details for SSL certificates?
You can view the historical order information for SSL certificates in the following ways:
Method 1: View through Billing Management
Log on to the Billing Management console.
In the left-side navigation pane, choose Orders > My Orders.
In the search bar, enter "SSL Certificate" or a specific order number to search.
After finding the target order, click Details to view the bill amount.
Method 2: View through the Certificate console
Log on to the SSL Certificates Service console.
In the left-side navigation pane, choose Comprehensive Management > Refund Management.
Find the corresponding historical order and click Details. You will be redirected to the Billing Management console to view the detailed information and bill amount of the order.
For V1.0 certificates, the certificate instance ID and order number may be inconsistent (orders and certificate resources are not bound), and you cannot directly query by resource ID. We recommend using the purchase time, certificate brand, and certificate type to help locate the target order.
Which SSL certificate services are free? Which require additional payment?
Free services:
Individual Test Certificate (Free): Each Alibaba Cloud account can apply for 20 individual test certificates (DV type) for free per calendar year. Each certificate has a validity period of 3 months. Unused quotas do not carry over to the next year.
Certificate upload: Manually uploading third-party certificates to Alibaba Cloud products (such as ALB, WAF, etc.) is free of charge.
Deployment of commercial certificates and individual test certificate (Pro): Deploying commercial certificates, individual test certificates, and certificates shared across different Alibaba Cloud accounts under the same verified identity to cloud products or cloud servers is free of charge.
Paid services:
Service Type | Fee Description |
Commercial Certificate (DV/OV/EV) | Requires purchase. Price varies by certificate brand, certificate type, and domain configuration. |
Cloud Product Deployment Service | When using one-click deployment to deploy an uploaded SSL certificate to a cloud product, you need to purchase a deployment count package. |
Cloud Server Deployment Service | When using one-click deployment to deploy an uploaded SSL certificate to a cloud server (ECS/Simple Application Server), you need to purchase a deployment count package. |
Certificate Auto-Managed Service | The auto-managed service fee does not include the certificate itself cost; certificates need to be purchased separately. |
How do I issue and download an invoice after renewing an SSL certificate?
Prerequisite for invoicing: You can apply for an invoice only after completing the purchase or renewal payment. You cannot apply for an invoice in advance during the period when the certificate has not expired and the renewal entry is not yet open.
Invoice title requirement: The invoice title must be consistent with the real-name verification entity of the Alibaba Cloud account.
If your account has personal real-name verification, a personal title invoice is issued by default.
If you need to issue a corporate title invoice, you can do so in the following ways:
Change real-name verification: Change the account to corporate real-name verification, then update to the latest entity information on the invoice information page before applying for invoicing.
Apply for a corporate title: On the invoice information page, click Apply for Corporate Title > Personal Apply for Corporate Title, and submit supporting documents such as employment certificates and labor contracts. After approval, you can issue an invoice with a corporate title.
Issue and download an invoice:
Log on to the invoice management page.
Select the corresponding renewal order and apply for an invoice.
After the invoice is issued, go to the Invoice Download and Return page to download the electronic invoice in PDF, OFD, or XML format from the operations column.
Why does the price displayed in the SSL Certificate console differ from the actual payment amount?
If the price displayed in the console differs from the actual payment amount, it is usually due to the following reasons:
Reason 1: Unpaid historical orders exist
If you previously created an SSL certificate order but did not complete the payment, that order may have included the promotional price at that time. A newly created order may use the current price (without the previous discount).
Resolution: Go to the Order List to check whether there are any unpaid orders. If there are unpaid orders, complete the payment or cancel the order before placing a new order.
Reason 2: The promotional offer has expired
If an unpaid order has been voided, the original first-purchase discount or limited-time discount may have expired when you purchase again, causing the price to return to the list price.
First-purchase discounts are valid only for the first order. After an order is voided, you will no longer be eligible for the first-purchase discount when purchasing again.