All Products
Search

This Product

    Certificate Management Service:Pre-authorize domains for automated SSL validation

    Document Center

    Certificate Management Service:Pre-authorize domains for automated SSL validation

    Last Updated:Nov 12, 2025

    To apply for an SSL certificate for a domain name, you must manually add a DNS record to verify domain ownership. This process can be tedious when you manage a large number of domains. Domain Pre-authorization lets you authorize your domains with Alibaba Cloud in advance by adding a one-time CNAME record. After that, when you apply for an SSL certificate from a supported Certificate Brand for that domain, the system automatically completes the ownership verification. This streamlines the application process and reduces certificate issuance time.

    Usage notes

    Before you begin, ensure your use case meets the following conditions.

    • Supported certificate brands:

      This feature currently supports only SSL certificates from DigiCert.

    • DNS provider compatibility:

      This feature is not supported if your domain uses the DNS service from West.cn.

    Configure domain pre-authorization

    Step 1: Add a domain for pre-authorization

    1. Go to the Domain pre-authorization page and click Add Domain Name.

    2. In the Add Domain Names panel, enter a domain, select a supported brand and an alert contact, and then click OK.

      • Separate multiple domains with commas (,). Public IP addresses are not supported.

      • If Alibaba Cloud detects an invalid CNAME record, it sends a notification to the selected alert contact.

    Step 2: Authorize the domain

    1. On the Domain Name-level Authorization for Verification-free Issuance page, find the target domain name in the list and copy the hostname and record value.

      image

    2. Add a CNAME record in your DNS provider's console.

      The following steps use Alibaba Cloud DNS as an example. If your domain's DNS is managed by a different provider, go to that DNS provider's console to add the record.

      1. Go to the Alibaba Cloud DNS console with the Alibaba Cloud account that owns the domain.

      2. On the Public Zone page, find the domain for your certificate and click Settings in the Actions column.

      3. On the Settings page, click Add Record.

      4. In the Add Record panel, set the record type to CNAME, enter the hostname and record value that you copied, and then click OK.

        image

        Important

        To ensure that your domain can skip verification when you apply for an SSL certificate, do not delete the CNAME record from your DNS settings.

    Step 3: Verify the authorization status

    1. Return to the Domain pre-authorization page.

    2. Find the target domain name. In the Actions column, click Verify. Alibaba Cloud checks whether the CNAME record is active.

      1. The DNS record may take some time to take effect globally. If the verification fails, wait a few minutes and try again.

      2. After verification, a status of Authorized indicates that the domain pre-authorization is complete.

    Apply for a certificate with a pre-authorized domain

    When you submit an SSL certificate request for a pre-authorized domain, select Manual DNS Verification for the Domain Verification Method.

    Note

    If Alibaba Cloud detects that the domain is pre-authorized, the system automatically skips all manual verification steps to complete domain ownership verification. To trigger the automatic verification process, you must select this option.

    image

    More operations

    • Modify the alert contact:

      In the Actions column, click Edit. Then, in the Edit Domain Name panel, modify the alert contact.

    • Delete a domain:

      In the Actions column, click Delete. In the dialog box, click OK.