All Products
Search

This Product

    Certificate Management Service:Create an SSL certificate

    Document Center

    Certificate Management Service:Create an SSL certificate

    Last Updated:Sep 09, 2026

    After purchasing a certificate, its status is Pending Application. Canceling the application returns the certificate quota to your account. This topic explains how to use your certificate quota to create an SSL certificate.

    Important

    • After purchase, a certificate defaults to the Pending Application state. You can then skip this topic and submit a request to the Certificate Authority (CA).

    • SSL Certificate Management V2.0 automatically creates a certificate in the Pending Application state after purchase. You do not need to create a certificate manually. This topic applies only to SSL Certificates Service (V1.0, which is no longer available for new purchases).

    Prerequisites

    You have purchased a paid certificate.

    Workflow

    image

    Procedure

    Log on to the Certificate Management Service console. In the left-side navigation pane, choose Certificate Management. On the Commercial Certificates tab, click Create Certificate.

    Step 1: Configure basic information

    Follow the instructions to configure the basic parameters. If you do not select Quick Issue, the certificate enters the Pending Application state after you provide the required information and click OK. You will need to submit an application to the Certificate Authority (CA) later.

    • Certificate Type

      The system displays the types of certificates that you have purchased and can create. This can include single domain, multi-domain, and wildcard types. You can select a type only if you have purchased the corresponding certificate resources.

    • Certificate Specifications

      Displays the certificate specifications you have purchased and their available quantities. If the required specification is not available, first purchase a commercial certificate.

    • Domain Name

      • Domain name requirements

        • Type matching: The domain type that you enter (single, multi-domain, or wildcard) must match your purchased certificate.

        • Length limits: The total length must not exceed 253 characters. Each label (a segment separated by the . character) must not exceed 63 characters.

      • Special format requirements

        • Wildcard: Must start with *, such as *.example.com.

        • Chinese domain name: If you use a Chinese domain name, you must convert it to Punycode as prompted in the console. You can also use a conversion tool. For more information, see Chinese Domain Name Conversion.

        • IP addresses: Supported only by some OV single-domain certificates (Brands: GlobalSign and GeoTrust).

      • Suffix restrictions: DigiCert-branded certificates cannot be issued for domain names with special suffixes, such as .edu, .gov, .org, .jp, .pay, .bank, .live, .nuclear, or .ru. This restriction does not apply to GlobalSign.

      • Complimentary domain name: If your domain name is eligible, Alibaba Cloud provides a complimentary domain name.

    • Validity Period (Years)

      Select the service duration for your certificate. Because certificate validity periods are decreasing, multiple certificates may be issued during the service period. For more information, see Changes in certificate validity periods.

    • Quick Issue

      If you select Quick Issue, you must provide application details. After the certificate is created, the system automatically submits the certificate application to the CA. You must then complete domain name ownership verification. You do not need to submit the application again.

    Step 2 (Optional): Provide application details (Quick Issue workflow)

    If you select Quick Issue, provide the details that the CA requires for review. The required information varies by certificate type (DV, OV, or EV). After you provide this information and click Submit for Review, the certificate status changes to Validating Application, and you must then complete domain name ownership verification.

    Certificate application information

    DV certificates

    • Domain Verification Method

      Note

      • Certificate purchase account: The Alibaba Cloud account used to purchase the target SSL certificate in the Certificate Management Service console.

      • DNS resolution account: The Alibaba Cloud account used to configure DNS resolution for the target domain name in Alibaba Cloud DNS.

      The purchase and DNS accounts are different

      • Manual DNS Verification (recommended): Log on to your DNS service platform and add a TXT DNS record.

      • File Verification: Log on to your web server, and create and upload the required validation file to the specified directory.

        Important

        Wildcard domain names do not support file validation.

      The purchase and DNS account are the same

      The system uses the Automatic DNS Verification method. Alibaba Cloud automatically adds a DNS record for the domain name in Alibaba Cloud DNS to verify domain ownership. No manual operation is required.

    • Contact

      Select a contact for this certificate application. The contact information includes an email address and a mobile number. To create or modify a contact, click Create Contact or Edit, or go to Contact Management.

    • Location

      Select the city or region where the applicant is located.

    • Encryption Algorithm

      Option

      Security

      Compatibility

      Performance

      Recommendation

      RSA_2048

      Medium

      Widest

      Middle

      Recommended for general use and suitable for most web applications.

      RSA_3072

      High

      Good

      Lower

      Suitable for scenarios with high security requirements, such as finance and payments.

      RSA_4096

      Very High

      Fair

      Low

      Recommended only for top-secret or extremely high-security scenarios.

      ECC_256

      High

      Good

      Very High

      Suitable for mobile applications, high-concurrency systems, and IoT devices.

      • RSA: An asymmetric key encryption algorithm based on the difficulty of factoring large integers. It is the most widely used and has excellent compatibility. Longer keys provide higher security but increase performance overhead.

      • ECC: An asymmetric key encryption algorithm based on the difficulty of the elliptic curve discrete logarithm problem. It achieves the same level of security as RSA with shorter keys, offers higher computational efficiency, and is suitable for resource-constrained environments such as mobile devices and IoT.

      Note

      Currently, only some brands and types of certificates support the ECC. For more information, see SSL certificate selection.

    • CSR Generation

      A Certificate Signing Request (CSR) is an application file submitted to a CA when you apply for an SSL certificate. It contains your domain name, organization information, and public key. You must securely store the corresponding private key.

      Automatic (recommended)

      Alibaba Cloud automatically creates a CSR and a private key for you. After the certificate is issued, you can directly download the complete file that contains the private key.

      Manual Entry

      You can use tools such as OpenSSL or Keytool to manually generate a CSR and a private key file, which you must store securely. Then, copy the CSR content into the CSR File configuration item. For more information about how to create a CSR and a private key file, see How to create a CSR file.

      Important

      • Securely store your private key. If you lose the private key, the certificate becomes unusable because the key is unrecoverable. You would need to generate a new key pair and request a certificate reissuance.

      • The encryption algorithm of the CSR must match the Key Algorithm selected above.

      Select an Existing CSR

      From the CSRs created or uploaded in the Certificate Management Service console, select the CSR that matches the Domains to Bind. For more information about how to create and upload a CSR, see Create a CSR.

    • CSR File

      This parameter is required only when CSR Generation is set to Manual or Select Existing CSR. Enter the content of your CSR file.

    OV certificates

    • Contact

      Select the contact for this certificate application. The contact information includes an email address and a mobile phone number. To create or modify a contact, click Create Contact or Edit, or go to Contact Management.

      Important

      After the CA receives the certificate application, it sends a validation email to the contact's email address or communicates with the contact using their mobile phone number for the review. Make sure that the contact information is accurate and valid.

    • Company

      Select the company information for this certificate application, including the name, phone number, and address. To create or modify company information, click Create Company Profile or Edit, or go to Company Information Management.

      Important

      When you apply for an OV certificate for a .gov domain name, the organization name in the domain's WHOIS information must exactly match the company name.

    • Business License

      After you select a Company, the system automatically identifies the business license picture uploaded for the company. If you did not upload a business license picture when you created the company, the business license picture is empty. To ensure a quick review by the CA, we recommend that you upload the company's business license picture.

    • Encryption Algorithm

      Option

      Security

      Compatibility

      Performance

      Recommendation

      RSA_2048

      Medium

      Widest

      Middle

      Recommended for general use and suitable for most web applications.

      RSA_3072

      High

      Good

      Lower

      Suitable for scenarios with high security requirements, such as finance and payments.

      RSA_4096

      Very High

      Fair

      Low

      Recommended only for top-secret or extremely high-security scenarios.

      ECC_256

      High

      Good

      Very High

      Suitable for mobile applications, high-concurrency systems, and IoT devices.

      • RSA: An asymmetric key encryption algorithm based on the difficulty of factoring large integers. It is the most widely used and has excellent compatibility. Longer keys provide higher security but increase performance overhead.

      • ECC: An asymmetric key encryption algorithm based on the difficulty of the elliptic curve discrete logarithm problem. It achieves the same level of security as RSA with shorter keys, offers higher computational efficiency, and is suitable for resource-constrained environments such as mobile devices and IoT.

      Note

      Currently, only some brands and types of certificates support the ECC. For more information, see SSL certificate selection.

    • CSR Generation

      A Certificate Signing Request (CSR) is an application file submitted to a CA when you apply for an SSL certificate. It contains your domain name, organization information, and public key. You must securely store the corresponding private key.

      Automatic (recommended)

      Alibaba Cloud automatically creates a CSR and a private key for you. After the certificate is issued, you can directly download the complete file that contains the private key.

      Manual Entry

      You can use tools such as OpenSSL or Keytool to manually generate a CSR and a private key file, which you must store securely. Then, copy the CSR content into the CSR File configuration item. For more information about how to create a CSR and a private key file, see How to create a CSR file.

      Important

      • Securely store your private key. If you lose the private key, the certificate becomes unusable because the key is unrecoverable. You would need to generate a new key pair and request a certificate reissuance.

      • The encryption algorithm of the CSR must match the Key Algorithm selected above.

      Select an Existing CSR

      From the CSRs created or uploaded in the Certificate Management Service console, select the CSR that matches the Domains to Bind. For more information about how to create and upload a CSR, see Create a CSR.

    • CSR File

      This parameter is required only when CSR Generation is set to Manual or Select Existing CSR. Enter the content of your CSR file.

    EV certificates

    • Contact

      Select the contact for this certificate application. The contact information includes an email address and a mobile phone number. To create or modify a contact, click Create Contact or Edit, or go to Contact Management.

      Important

      After the CA receives the certificate application, it sends a validation email to the contact's email address or communicates with the contact using their mobile phone number for the review. Make sure that the contact information is accurate and valid.

    • Company

      Select the company information for this certificate application, including the name, phone number, and address. To create or modify company information, click Create Company Profile or Edit, or go to Company Information Management.

      Important

      When you apply for an OV certificate for a .gov domain name, the organization name in the domain's WHOIS information must exactly match the company name.

    • Business License

      After you select a Company, the system automatically identifies the business license picture uploaded for the company. If you did not upload a business license picture when you created the company, the business license picture is empty. To ensure a quick review by the CA, we recommend that you upload the company's business license picture.

    • Encryption Algorithm

      Option

      Security

      Compatibility

      Performance

      Recommendation

      RSA_2048

      Medium

      Widest

      Middle

      Recommended for general use and suitable for most web applications.

      RSA_3072

      High

      Good

      Lower

      Suitable for scenarios with high security requirements, such as finance and payments.

      RSA_4096

      Very High

      Fair

      Low

      Recommended only for top-secret or extremely high-security scenarios.

      ECC_256

      High

      Good

      Very High

      Suitable for mobile applications, high-concurrency systems, and IoT devices.

      • RSA: An asymmetric key encryption algorithm based on the difficulty of factoring large integers. It is the most widely used and has excellent compatibility. Longer keys provide higher security but increase performance overhead.

      • ECC: An asymmetric key encryption algorithm based on the difficulty of the elliptic curve discrete logarithm problem. It achieves the same level of security as RSA with shorter keys, offers higher computational efficiency, and is suitable for resource-constrained environments such as mobile devices and IoT.

      Note

      Currently, only some brands and types of certificates support the ECC. For more information, see SSL certificate selection.

    • CSR Generation

      A Certificate Signing Request (CSR) is an application file submitted to a CA when you apply for an SSL certificate. It contains your domain name, organization information, and public key. You must securely store the corresponding private key.

      Automatic (recommended)

      Alibaba Cloud automatically creates a CSR and a private key for you. After the certificate is issued, you can directly download the complete file that contains the private key.

      Manual Entry

      You can use tools such as OpenSSL or Keytool to manually generate a CSR and a private key file, which you must store securely. Then, copy the CSR content into the CSR File configuration item. For more information about how to create a CSR and a private key file, see How to create a CSR file.

      Important

      • Securely store your private key. If you lose the private key, the certificate becomes unusable because the key is unrecoverable. You would need to generate a new key pair and request a certificate reissuance.

      • The encryption algorithm of the CSR must match the Key Algorithm selected above.

      Select an Existing CSR

      From the CSRs created or uploaded in the Certificate Management Service console, select the CSR that matches the Domains to Bind. For more information about how to create and upload a CSR, see Create a CSR.

    • CSR File

      This parameter is required only when CSR Generation is set to Manual or Select Existing CSR. Enter the content of your CSR file.

    Advanced settings

    Use the Advanced Settings to configure the Notification service for the certificate lifecycle.

    • Notification Status: Enabled by default.

    • Notification Method: You can configure Email Address, Text Message, Internal Message, and DingTalk/WeCom/Feishu.

    • Notification Content: You can configure three types of reminder messages: Business Notification, Alert Notification, and Product Change Notification.

    • Expiration Notification Frequency: Configure a reminder frequency policy. Options include: Only Once, Every Day, Every 3 Days, Every 5 Days, and Every 7 Days.

    • Expiration Deadline Notification: Configure how many days in advance to send reminders. Options include: 15 Days Before Expiration, 30 Days Before Expiration, 60 Days Before Expiration, and 90 Days Before Expiration.

    Important

    The service period for the message reminder feature matches the validity period of the certificate. The service ends automatically when the certificate expires.

    Next steps

    Scenario 1: You selected Quick Issue.

    After the certificate is created, the system automatically submits a certificate application to a CA. To track the application, hover over the Status icon in the Status column and click View Progress in the tooltip. The Certificate Progress panel shows the review progress. You must then complete the domain name ownership verification.

    Scenario 2: You did not select Quick Issue.

    After a certificate is created, it appears in the certificate list with the status Pending Application. You must submit the certificate application to a CA for review. The CA issues the certificate only after your application is approved. For more information, see Submit an Application to a CA.

    Complimentary domain rules

    When you purchase a certificate, the system includes one complimentary associated domain if the conditions are met.

    Conditions for a complimentary domain

    Note

    In this topic, a second-level domain is a domain such as aliyun.com, in which .com is the top-level domain. www.aliyun.com and demo.aliyun.com are third-level domains. demo.doc.aliyun.com is a fourth-level domain, and so on.

    DigiCert

    • DV: The domain validation method must be DNS validation.

    • OV and EV: The domain must be a second-level domain.

    Alibaba Cloud

    The bound domain must be the www subdomain of a second-level domain.

    Note

    • The primary domain name aliyun.com is included only if you bind www.aliyun.com.

    • If you bind a domain such as aliyun.com or *.aliyun.com, the corresponding www subdomain is not included.

    Complimentary domain rules

    • Single-domain certificate:

      • If you bind a primary domain name, the www subdomain is included. For example, if you bind aliyun.com, www.aliyun.com is included.

      • If you bind a www subdomain, the primary domain name is included. For example, if you bind www.aliyun.com, aliyun.com is included.

    • Wildcard certificate:

      • If you bind a wildcard domain, the corresponding primary domain name is included. For example, if you bind *.aliyun.com, aliyun.com is included.

    • Multi-domain certificate:

      • A complimentary domain is included only if the first domain meets the conditions. Only the domain associated with the first domain is included. For example, if the certificate binds a.aliyun.com and b.aliyun.com, only www.a.aliyun.com is included.

    FAQ

    Insufficient certificate quota

    Cause

    Solution

    Quota is occupied by certificates in the "Pending Application" state

    Check your certificate list for unneeded certificates in the "Pending Application" state. Click "Cancel Application". The quota is returned immediately after cancellation.

    Important

    The quota is not returned if a certificate is revoked or deleted.

    All purchased quota is used or occupied

    To purchase additional certificate quota, go to the Purchase a paid certificate page.

    Zero available certificates after purchase

    If the Create Certificate page shows 0 available certificates even though you have already purchased a certificate or claimed an Individual Test Certificate, this does not mean your quota is missing. SSL Certificate Management V2.0 has switched to a subscription model. After you purchase a certificate, the system automatically creates a certificate instance in the Pending Application state, so you do not need to manually create a certificate. A count of 0 on the Create Certificate page is expected behavior. Please view the purchased certificates on the SSL Certificate Management V2.0 page.

    Chinese (IDN) domain names

    When you apply for a certificate for a Chinese (IDN) domain name, you must convert it to Punycode. You can follow the prompts in the console or use a conversion tool. For more information, see Chinese Domain Name Conversion.