Certificate Management Service:What is an SSL certificate?

Certificate issuance and validation (trust chain construction)

1. Generate request: The server generates a key pair (RSA 2048-bit or ECC 256-bit) and encapsulates the public key and organization information into a Certificate Signing Request (CSR).

2. CA signing: After verifying domain ownership, the CA extracts the public key and applicant information from the CSR, combines it with issuer information and validity period, and signs with its private key to generate an X.509-compliant certificate.

3. Trust chain: Browsers verify server certificate signatures against pre-installed root certificates, establishing a chain of trust.

Encrypted session establishment (TLS handshake)

1. Handshake initiation: The client sends a ClientHello message with supported protocol versions and cipher suites.

2. Certificate delivery: The server responds with a ServerHello message and sends the certificate chain.

3. Identity verification: The client verifies the certificate's validity period and domain match, and checks revocation status via CRL or OCSP. Some deployments use OCSP Stapling to optimize this step.

4. Key exchange: Both parties generate a session key through a key exchange mechanism.

   • ECDHE mode (recommended): Both parties generate temporary key pairs, exchange public keys, and independently derive the session key.

   • RSA mode (traditional): The client generates a pre-master secret, encrypts it with the server's public key, and sends it. Both parties then derive the session key.

5. Symmetric communication: After the handshake, all data is encrypted using the session key.

Purchase certificate

SSL certificates must be purchased separately from domain names. Alibaba Cloud does not bundle certificates with domain purchases.

Alibaba Cloud offers free personal test SSL certificates: up to 20 per year, each valid for 3 months. These suit personal websites or testing environments. For production, purchase a commercial certificate.

In the Digital Certificate Management Service console, use the Free Certificate tab to apply for and manage certificates.

1. Select a certificate type based on your business needs. SSL Certificate Selection Guide.

2. Refer to Purchase a commercial certificate to fill in the certificate purchase information.

Validity period

SSL certificates have two validity periods:

• Subscription validity period: The duration of your SSL certificate order, calculated from the date when the certificate is first issued.

• Issuance validity period: The CA-certified validity window. After expiry, the trust chain breaks, causing service disruption or security warnings. Calculated from the CA issuance date.

CA/B Forum standards cap the issuance validity per certificate. You must reapply and deploy a new certificate before the issuance validity expires within your subscription period to avoid service disruption.

Example:

You purchase a one-year certificate on 2026/05/01. The CA issues it on 2026/05/10. With a 199-day maximum issuance validity (illustrative), the first certificate expires on 2026/11/25. You must reapply before then. The new certificate expires on 2027/05/10, ending the one-year subscription.

Create certificate

If you did not bind a domain during purchase, create a certificate to associate the quota with a domain. The system provides a Quick Issue option:

• Select Quick Issue: Provide the required application information. The system automatically submits the request to the CA. You then only need to complete domain ownership verification.

• If you do not select Quick Issue: Manually submit the request in the console after creation. Submit a request to a certification authority (CA).

Request certificate

1. Submit a request to the Certification Authority (CA)

   Submit an application to a CA with the required information (domain name or IP, contact, company, and business license). Request certificate.

2. Domain Name Ownership Verification

   Verify domain ownership when submitting the application. Domain ownership validation.

   • DV certificates support three validation methods: Automatic DNS Verification, Manual DNS Verification, and File Verification.

   • EV/OV certificates: Complete validation based on the domain verification email content sent by the CA.

3. CA Review

   After submitting the application and completing domain validation, wait for the CA review. Track progress in CA review result handling. DV certificates typically take 1–15 minutes; OV and EV certificates take about 5 calendar days.

Deploy certificate

After the certificate status changes to "Issued," ensure the following conditions are met for it to take effect:

• The certificate is deployed to your web server (Nginx, Apache, or IIS) or cloud product, and the service is restarted.

• The client (browser) trusts the issuing CA.

After deployment, your site uses HTTPS. Deploy SSL certificate.

What to do next

What if I cannot find the certificate after purchase?

If you skip domain information during purchase, you receive an entitlement rather than a ready-to-use certificate. The certificate appears in the list only after you create an SSL certificate and bind a domain.

Do SSL certificates support Chinese domain names?

Yes, they do. If you want to secure a Chinese domain name, you must convert it to Punycode as prompted in the console before you can apply for a certificate. You can also use a transcoding tool to convert the domain name. For more information, see Chinese domain name conversion.