All Products
Search

This Product

    Certificate Management Service:Purchase a commercial certificate

    Document Center

    Certificate Management Service:Purchase a commercial certificate

    Last Updated:Sep 21, 2026

    This topic describes how to select and purchase an SSL certificate in Alibaba Cloud Certificate Management Service. It covers quick selection tips based on website type, number of domains, and brand. It also describes the steps for the two purchase methods, Purchase by Domain Name and Purchase by Quantity, the complimentary domain rules, and answers to common questions.

    Quick selection

    Important

    Your answers to the following questions map directly to the options that you set when you Purchase a certificate.

    Question 1: How many domains do you need to protect?

    • One domain (such as aliyun.com or login.aliyun.com): Select a Single Domain certificate.

    • All subdomains of one primary domain name (such as *.aliyun.com): Select a Wildcard Domain certificate.

    • Multiple domains (such as aliyun.com, taobao.com, and *.aliyun.com): Select a Multiple Domains certificate.

    Note

    For some certificates, the system includes one complimentary associated domain. For more information, see Complimentary domain rules.

    Question 2: What type of website do you have?

    • A personal website or a development or test environment: Select a DV (Domain Validated) certificate. Only domain ownership is verified. The certificate is issued automatically in 1 to 15 minutes on average, and the cost is low.

    • An enterprise website or an internal information system: Select an OV (Organization Validated) certificate. The organization identity is verified, so security is higher. The certificate details show the organization name. The average issuance time is 5 calendar days.

    • A website with high security requirements, such as a financial, e-commerce, or government website: Select an EV (Extended Validation) certificate. EV certificates use the strictest identity verification standards and provide the highest level of trust. The certificate details show the full organization name, which maximizes user trust. The average issuance time is 5 calendar days.

    Question 3: How do you select a certificate brand?

    • You need global recognition: DigiCert is recommended.

    • You value service stability: GlobalSign is recommended.

    • You are cost-sensitive: Alibaba Cloud is recommended.

    Note

    The preceding items are quick selection tips. For a more complete selection guide, see SSL certificate selection guide.

    Purchase a certificate

    To obtain a certificate, you must submit a purchase order and then request the certificate from a certificate authority (CA).

    image

    Step 1: Select certificate options

    Go to the SSL Certificate Management V2.0 page. On the Commercial Certificates tab, click Purchase Certificate. Then, configure the certificate based on the following information.

    • Domain Type:

      • Single Domain: An SSL certificate is attached to a primary domain name, a subdomain, or a public IP address (IPv4). Examples: aliyun.com, abc.example.com, and 1.1.X.X.

      • Wildcard Domain: A wildcard certificate is used to protect a primary domain name and all its first-level subdomains.

        • Matching rules: Matches only subdomains at the same level. It cannot match subdomains across multiple levels. For example, a certificate for *.aliyun.com can match demo.aliyun.com, but cannot match guide.demo.aliyun.com.

        • Limits: By default, a certificate supports only one wildcard domain name. To include multiple wildcard domain names in a single certificate, see Merge certificate requests.

      • Multiple Domains: Used to attach multiple single domain names at the same time. You can attach up to five single domain names. Only single domain names are supported. Wildcard domain names are not supported.

    • Certificate Type:

      The available certificate types vary based on the domain type.

      • DV: A domain-validated certificate. Only domain control is verified. It is suitable for personal websites, informational sites, and enterprise or personal test environments. It is the fastest to issue and the most affordable.

      • OV: An organization-validated certificate. Both the domain and the organization identity are verified. It is suitable for government organizations, small and medium-sized enterprises, and educational institutions.

      • OV_PRO: Provides a higher encryption level and stronger security than an OV SSL certificate.

      • EV: An extended validation certificate that uses the strictest organization verification. It is suitable for large enterprises, financial institutions, e-commerce sites, and other websites that handle payment transactions and private data.

      • EV_PRO: Provides a higher encryption level and stronger security than an EV SSL certificate.

    • Brand:

      Rapid, DigiCert, GlobalSign, GeoTrust, and Alibaba Cloud are supported. For more information, see SSL certificate selection guide.

      Important

      DigiCert does not issue certificates for domains that use special suffixes, such as .edu, .gov, .org, .jp, .pay, .bank, .live, .nuclear, and .ru.

    • Number of single domains: The maximum number of single domains that one certificate instance supports.

    • Number of wildcard domains: The maximum number of wildcard domains that one certificate instance supports.

    Step 2: Select a certificate automation service

    When you purchase an SSL certificate, you must select the Automation Service Edition that you need. The options are described as follows:

    • Automation Service Edition

      Required. The following options are available:

      • Standard Edition: Includes custom notifications, one-click deployment to cloud services (unlimited), and public domain name monitoring (one domain included).

      • Professional Edition (Recommended): Includes custom notifications, one-click deployment to cloud services (unlimited), public domain name monitoring (one domain included), auto-managed certificate, and server deployment (one node included).

      • Ultimate: Includes custom notifications, one-click deployment to cloud services (unlimited), public domain name monitoring (100 domains included), auto-managed certificate, and server deployment (100 nodes included).

    • Add-ons for automation services

      If you need more domain name monitoring or server deployment quotas than the selected Automation Service Edition includes, purchase additional quotas.

    Step 3: Select the quantity and duration

    Select the number of certificate instances and the service duration that you want to purchase.

    • Number of certificate instances: The number of SSL certificate instances to purchase. If you purchase more than one instance, all instances use the same options and service duration, and each instance is billed based on the preceding options.

    • Service duration: The duration of the certificate service that you subscribe to or purchase.

      Important

      A purchase or subscription period can include multiple certificates that have different validity periods. For more information about certificate validity periods, see Changes to certificate validity periods.

    Step 4: Confirm the order and pay

    Click Buy Now. Read and accept the Terms of Service, and then click Buy Now to complete the payment. After the purchase, you can view your SSL certificate orders on the Order and Refund Management page.

    Step 5: View the purchased certificate

    After the purchase, the certificate appears on the SSL Certificate Management V2.0 page. The certificate status is Pending Application.

    Next steps

    If a certificate has the Pending Application status, you must submit a request to a certification authority (CA). A certificate is issued after the CA approves the request.

    Complimentary domain rules

    When you purchase a certificate, the system includes one complimentary associated domain if the conditions are met.

    Conditions for a complimentary domain

    Note

    In this topic, a second-level domain is a domain such as aliyun.com, in which .com is the top-level domain. www.aliyun.com and demo.aliyun.com are third-level domains. demo.doc.aliyun.com is a fourth-level domain, and so on.

    DigiCert

    • DV: The domain validation method must be DNS validation.

    • OV and EV: The domain must be a second-level domain.

    Alibaba Cloud

    The bound domain must be the www subdomain of a second-level domain.

    Note

    • The primary domain name aliyun.com is included only if you bind www.aliyun.com.

    • If you bind a domain such as aliyun.com or *.aliyun.com, the corresponding www subdomain is not included.

    Complimentary domain rules

    • Single-domain certificate:

      • If you bind a primary domain name, the www subdomain is included. For example, if you bind aliyun.com, www.aliyun.com is included.

      • If you bind a www subdomain, the primary domain name is included. For example, if you bind www.aliyun.com, aliyun.com is included.

    • Wildcard certificate:

      • If you bind a wildcard domain, the corresponding primary domain name is included. For example, if you bind *.aliyun.com, aliyun.com is included.

    • Multi-domain certificate:

      • A complimentary domain is included only if the first domain meets the conditions. Only the domain associated with the first domain is included. For example, if the certificate binds a.aliyun.com and b.aliyun.com, only www.a.aliyun.com is included.

    FAQ

    What do I do if I purchased a certificate with the wrong specifications?

    If you selected the wrong specifications, such as the domain type, brand, or number of domains, take action based on the certificate status and the purchase time:

    • Within 7 days of the purchase and the certificate is not issued: Go to the Refund Management page to request a refund, and then purchase a new certificate.

    • More than 7 days after the purchase, or the certificate is issued: Refunds are not supported. For security, you can revoke the issued certificate.

    What do I do if I entered the wrong domain when I submitted the certificate request?

    If the domain is misspelled in the certificate request, but the certificate specifications are correct, perform the Cancel Application operation. After you cancel the request, enter the certificate information again.

    Can I use a certificate that I purchased from a different product page?

    Yes. All SSL certificates are managed by Certificate Management Service, no matter whether you purchase them from a cloud service page, the Certificate Management Service console, or another Alibaba Cloud product page. The purchase entry point does not affect the certificate. Certificates that have the same specifications, which include the domain type, certificate type, and brand, use the same request, issuance, and deployment methods.

    After the purchase, log on to the Certificate Management Service console. In the left-side navigation pane, choose Certificate Management to go to the SSL Certificate Management page. On the Commercial Certificates tab, you can view and manage all purchased certificates.

    If you cannot find a purchased certificate in the list, check whether the order is paid. Go to the Order and Refund Management page to view the order status.