Selecting the right SSL certificate is critical for securing your website, building visitor trust, and meeting compliance requirements. This topic uses business scenarios to help you accurately identify the validation level, domain type, encryption algorithm, and brand that your certificate requires, so that you can efficiently choose an optimal solution that balances security, compatibility, and cost-effectiveness.
Quick selection
Scenario 1: Personal, development, or test use
Use cases: Ideal for non-commercial and non-production purposes, such as personal blogs, portfolio websites, local development environments, CI/CD testing pipelines, and educational demonstrations.
Key needs: Low cost, fast deployment, and no need for high availability.
Recommended certificate type: DV single-domain certificate.
Recommended brand: Alibaba Cloud.
Scenario 2: SMEs, e-commerce, and mini programs
Use cases: Public-facing production systems such as corporate websites, small to medium-sized e-commerce platforms, backend services for WeChat mini programs, and SaaS application gateways.
Key needs: Stable HTTPS encryption, a moderate level of trust, and high cost-effectiveness.
Recommended certificate type: DV wildcard certificate or OV single-domain certificate.
Validation level: DV or OV.
Domain support: Wildcard (
*.aliyundoc.com) or single domain.Recommended brands: Rapid, GeoTrust, DigiCert.
Important notes:
To protect multiple subdomains, a wildcard certificate is recommended.
If you want to display your company's information in the certificate to enhance user trust, choose an OV certificate.
Scenario 3: Finance, government, or high-trust services
Use cases: Mission-critical systems with extremely high security and compliance requirements, such as online banking, securities trading systems, government service platforms, large enterprise customer portals, and payment gateways.
Key needs: The highest level of identity assurance, industry compliance, and brand credibility.
Recommended certificate type: EV certificate or OV certificate.
Validation level: EV / OV.
Domain support: Single or multiple domains, depending on the business architecture. EV certificates do not support wildcard domains due to industry standard limitations. If you need a wildcard certificate, choose an OV certificate.
Recommended brands: GeoTrust, GlobalSign, DigiCert.
Important notes:
Major modern browsers, such as Chrome, Edge, and Safari, no longer display the company name directly in the address bar (the "green bar"). Company information now appears in the certificate details panel.
EV certificates still provide the highest standard of identity verification and have full legal validity. They remain the top choice for finance and government systems to prevent phishing attacks and build user trust.
Scenario 4: Public IP address access
Use cases: Devices or systems that serve traffic directly over a public IPv4 address and cannot be configured with a domain name, such as IoT gateways, edge servers, or legacy systems.
Recommended certificate type: OV single-domain certificate (supports IP).
Validation level: OV.
Domain support: Public IPv4 address (only for specific brands).
Recommended brands: GlobalSign, DigiCert, GeoTrust.
Important notes: Only OV single-domain certificates from GlobalSign, DigiCert, GeoTrust support binding to an IP address.
Selection parameters
Selection process
Use this guide to select a certificate that fits your business needs:
Step 1: Validation level
If you only need basic HTTPS encryption and do not need to display company information → Choose DV.
To display your organization's identity in the certificate and build user trust → Choose OV.
If you operate in a high-compliance sector such as finance, government, or payments → Choose EV.
Step 2: Domain type
To protect only a single domain (e.g.,
www.example.com) → Choose a single-domain certificate.To protect all subdomains under the same root domain (e.g.,
*.example.com) → Choose a wildcard certificate.To protect multiple different domains (e.g.,
a.com+b.com) → Choose a multi-domain certificate.To protect both wildcard and single domains → Choose a hybrid-domain certificate.
To secure a public IP address directly (without a domain) → Choose a certificate that supports IP addresses (only some OV certificates support this feature).
Step 3: Encryption algorithm
For the widest compatibility (compatible with older devices and browsers) → Choose the RSA algorithm.
For higher performance and stronger security (ideal for mobile, IoT, etc.) → Choose the ECC algorithm.
Step 4: Certificate brand
Based on your budget and preferences, review the Pricing Information and select a brand from Certificate Brands.
Validation levels (DV / OV / EV)
SSL certificates are classified by validation level: DV (Domain Validated), OV (Organization Validated), and EV (Extended Validation). These validation levels differ in required verification materials, average issuance time, and browser trust indicators.
For personal websites without company information, you can only apply for a DV SSL certificate.
Feature | DV (Domain Validated) | OV (Organization Validated) | EV (Extended Validation) |
Use case | Personal websites, app services, and development or testing environments. | Government organizations, small to medium-sized enterprises (SMEs), and educational institutions. | E-commerce sites, financial institutions, and large enterprises that handle transactions or sensitive private data. |
Validation level | Low. The certificate authority (CA) only verifies domain ownership. | Medium. The CA verifies the organization's real-world identity. | High. The CA strictly verifies the organization's identity and legal status. |
Verification method and documents | DNS verification. | Email or phone. Requires domain verification and submission of company information, and other documents. | Email or phone. Requires domain verification and submission of company information, and other documents. |
Average issuance time | 1–15 minutes. | 5 calendar days | 5 calendar days |
Domain types (single domain / wildcard / multi-domain)
An SSL certificate must be bound to a domain name or IP address to take effect. The number and types of domains you need to secure determine the required certificate type and quantity. Alibaba Cloud supports certificates for the following domain types: single domain, multi-domain, and wildcard domain. The following table compares these domain types and describes their corresponding certificates.
Domain type | Description | Notes |
Single domain | Binds one certificate to a single, fully qualified domain name, such as | Supports DV, OV, and EV validation levels. If a subdomain not covered by the certificate is accessed over HTTPS, the browser displays a "Not secure" warning. To cover multiple subdomains, select a wildcard certificate. |
Multi-domain | Binds one certificate to multiple domains or IP addresses. | To secure an IP address, you must use an OV certificate from a brand that supports IP addresses. |
Wildcard domain | Uses the format For example, a wildcard domain |
|
IP | Binds a single certificate to one public IPv4 address. | Only OV single-domain certificates from GlobalSign, DigiCert, and GeoTrust support IP address binding. |
After a certificate is purchased and issued, it may include additional domains for free if certain conditions are met. For more information, see Rules for free domains included with SSL certificates.
Encryption algorithm (RSA / ECC)
RSA: An asymmetric encryption algorithm known for its excellent compatibility and widespread adoption.
ECC (elliptic curve cryptography): A modern asymmetric encryption algorithm that offers stronger security, faster performance, and lower resource consumption compared to RSA and is now widely supported by major browsers.
Item | RSA algorithm | ECC algorithm |
Security and key length | Requires a longer key length. Supported key lengths are 2048-bit and 4096-bit. | Achieves the same security level with a much smaller key length.
|
Performance / Speed | Slower. | Faster, especially in resource-constrained environments like mobile and Internet of Things (IoT) devices. |
Memory and CPU usage | High. | Low. |
Compatibility | High. | Good, but not as widespread as RSA. |
The following table lists the encryption algorithms supported by each SSL certificate brand and type.
Certificate brand | Certificate type | RSA | ECC | ||||||
Signature algorithm | Key length | Signature algorithm | Key length | ||||||
SHA256withRSA | SHA384withRSA | 2048 | 4096 | SHA256withECDSA | SHA384withECDSA | prime256v1 | secp384r1 | ||
DigiCert | DV | ||||||||
OV | |||||||||
EV | |||||||||
GeoTrust | OV | ||||||||
EV | |||||||||
GlobalSign | DV | ||||||||
OV | |||||||||
Rapid | DV | ||||||||
Alibaba Cloud | DV | ||||||||
By default, SSL certificates are signed with the SHA256withRSA or SHA256withECDSA signature algorithm. You cannot select a signature algorithm that uses the SHA384 hash function on the Certificate Management Service console. To issue a certificate with this signature algorithm, you must create a CSR file locally and upload it to the console. For more information, see How to Create a CSR File and Upload CSR.
Certificate brands
When choosing a certificate brand, consider factors such as its supported validation levels, domain types, encryption algorithms, and price, as well as your business requirements and budget.
If you need help choosing a certificate brand, visit the product details page and fill out the "certificate management service product inquiry" form to get pre-sales support.
Certificate brand | Description |
DigiCert | A premium certificate brand from DigiCert with high brand recognition. Issued from the DigiCert root. |
Geotrust | A mid-range certificate brand from DigiCert with strong brand awareness and a complete product line. Issued from the DigiCert root. |
Rapid | An entry-level certificate brand from DigiCert. Issued from the DigiCert root. |
GlobalSign | A brand from GlobalSign. Issued from the GlobalSign root. |
Alibaba Cloud | Alibaba Cloud's own brand. Issued from the DigiCert root. |
CFCA | A digital certificate brand from China Financial Certification Authority (CFCA). A Chinese domestic SSL certificate brand. |
vTrus | An SSL certificate brand from Tianwei Trust. A Chinese domestic SSL certificate brand. |
WoSign | A digital certificate brand from WoSign CA. A Chinese domestic SSL certificate brand. |
SHECA | SHECA (Shanghai CA) certificates. A Chinese domestic SSL certificate brand. |
Certificate brand | Certificate authority | Description |
DigiCert | DigiCert, Inc. | A premium certificate brand from DigiCert with high brand recognition. |
Geotrust | A mid-range certificate brand from DigiCert with strong brand awareness and a complete product line. | |
Rapid | Rapid is an entry-level SSL certificate brand from DigiCert. It focuses on providing fast-issuance, cost-effective domain-validated (DV) certificates, which are ideal for the basic encryption needs of personal websites and small businesses. | |
GlobalSign | GMO GlobalSign Pte Ltd. | GlobalSign is one of the earliest certificate authorities (CAs). It specializes in cybersecurity certification and digital certificate services and is a trusted SSL certificate provider. |
Alibaba Cloud | DigiCert, Inc. | Alibaba Cloud's own brand, issued from the DigiCert root. |
Pricing
The price of an SSL certificate varies by certificate type, validation level, domain type, and certificate brand. Choose a certificate that fits your actual requirements and budget. For the actual certificate price, see the Certificate Service purchase page.
Purchase a certificate
To purchase a certificate, see Buy a Commercial Certificate.
FAQ
Which certificate should I choose if I only have a public IP address and no domain name?
Choose an OV single-domain certificate that supports IP addresses. When purchasing, select an OV certificate from one of the following brands: GlobalSign, DigiCert, GeoTrust. When applying, enter your public IP address.
Do I need to redeploy the certificate after renewal or reissuance?
Yes. Each renewal or reissuance generates a new certificate. You must download the new certificate and deploy it to your web server to replace the old one.
If you renew your certificate for multiple years and used Cloud Product Deployment for the previous certificate, Certificate Management Service (Original SSL Certificate) will automatically deploy the new one using Cloud Product Managed Deployment after it is issued. If the deployment fails, you will receive a notification by email, and internal message.
Does a wildcard certificate (for example, *.aliyundoc.com) include the root domain (aliyundoc.com)?
Yes. A certificate for a wildcard domain also includes the root domain for free. For example, a certificate for *.aliyundoc.com also protects aliyundoc.com.
After a certificate is purchased and issued, it may include additional domains for free if certain conditions are met. For more information, see Rules for free domains included with SSL certificates.
Do price differences among SSL certificates affect actual usage?
SSL certificates from different vendors may vary in encryption strength, browser compatibility, trust level, validation rigor, and value-added services—all of which can impact real-world performance. Price differences typically reflect variations in validation level, brand reputation, feature set, and intended use cases, meaning that practical effectiveness is not uniform across all certificates.
Why did I receive an email from DigiCert after purchasing a GeoTrust SSL certificate?
This is normal. GeoTrust is a sub-brand of DigiCert, and the root certificates for both brands are actually provided by DigiCert. Therefore, receiving an email from DigiCert after purchasing a GeoTrust certificate is expected behavior and does not affect the normal use of your certificate.
What happens when a subdomain not covered by a single-domain certificate is accessed over HTTPS?
A single-domain certificate covers only the single domain that you applied for. For example, if you apply for a single-domain certificate only for www.aliyundoc.com, when you access the HTTPS URL of another subdomain such as a.aliyundoc.com, the browser displays a "Not secure" warning, the same as when no SSL certificate is deployed. To protect multiple subdomains, apply for a wildcard certificate (such as *.aliyundoc.com), which covers the root domain and all same-level subdomains.