Certificate Management Service:What is an SSL certificate?

Certificate issuance and validation (building the trust chain)

1. Request generation: The server generates a key pair (RSA 2048-bit or ECC 256-bit) and packages the public key with organization information into a Certificate Signing Request (CSR).

2. CA signing: After validating domain ownership, the Certificate Authority (CA) extracts the public key and applicant information from the CSR. The CA then combines this with issuer details, validity period, and extensions to construct the certificate content. Finally, it digitally signs the content with its private key to generate an X.509 standard certificate.

3. Trust establishment: The browser verifies the server certificate's signature by tracing it back to a pre-installed Root Certificate. This process establishes the Trust Chain.

Encrypted session establishment (TLS handshake)

1. Handshake initiation: The client sends a ClientHello message, which includes a list of supported protocol versions and Cipher Suites.

2. Certificate transfer: The server responds with a ServerHello message and sends its Certificate Chain.

3. Identity authentication: The client verifies the certificate's validity period and domain name match. It also confirms the certificate has not been revoked by checking a Certificate Revocation List (CRL) or by using the Online Certificate Status Protocol (OCSP). Some deployments use OCSP Stapling to optimize this process.

4. Key exchange: Both parties use a key exchange mechanism to generate a session key.

   • ECDHE mode (recommended): Both parties generate temporary key pairs, exchange public keys, and independently calculate the same Session Key.

   • RSA mode (legacy): The client generates a pre-master secret, encrypts it with the server's public key, and sends it. The server then decrypts it, and both parties derive the Session Key.

5. Symmetric communication: After the TLS Handshake is complete, all subsequent data is symmetrically encrypted with the Session Key.

Purchase a certificate

1. Choose a certificate type that meets your business needs. For details, see SSL certificate selection guide.

2. Fill in the required information to purchase the certificate. For details, see Purchase commercial certificates.

Create a certificate

If you did not specify a domain to secure during the purchase, you must first create a certificate to link your purchased quota to a domain. The system provides a Quick Issue option during this process:

• Select Quick Issue: You need to fill in the application information. After the certificate is created, the system automatically submits an application to the CA. You only need to complete the Domain ownership verification.

• Do not select Quick Issue: After the certificate is created, you need to log on to the console and manually fill out and submit the application. For more information, see Submit an application to CA.

Apply for a certificate

1. Submit an application to the CA

   You need to provide information based on the certificate type, such as the domain name or IP address that the certificate secures, contact information, company details, and business licenses. Then, submit the application to the CA. For more information, see Apply for a certificate.

2. Domain ownership verification

   When submitting your application to the CA, you need to verify that you own the domain name. For more information, see Domain Ownership Validation.

   • Domain validated (DV) certificates support three verification methods: Automatic DNS Verification, Manual DNS Verification, and File Verification.

   • For organization validated (OV) and extended validation (EV) certificates, follow the instructions in the domain verification email sent by the CA to complete the process.

3. CA review

   After you submit the application and complete the domain ownership verification, the CA reviews your application. To check the review status and results, see Handle CA review results. DV certificates are typically issued within 1 to 15 minutes. OV and EV certificates are typically issued within 5 calendar days.

Deploy a certificate

Once your certificate is issued, deploy the certificate files to your web server (such as Nginx, Apache, or IIS) or cloud service to enable HTTPS on your site. For more information, see Deploy SSL certificate.

Lifecycle management

Purchased certificate not found?

If you did not specify a domain to secure during the purchase, you only acquired a certificate quota, not the certificate itself. It will not appear in the certificate list. You need to Create an SSL certificate and specify a domain before it becomes visible.

Do SSL certificates support Chinese domain names?

Yes. If you want to secure a Chinese domain name, you must convert it to Punycode as prompted in the console before you can apply for a certificate. You can also use a transcoding tool to convert the domain name. For more information, see Convert a Chinese domain name.

Can I apply for an Alibaba Cloud SSL certificate if my DNS provider is not Alibaba Cloud?

Yes, you can. You only need to complete the domain ownership validation. This is independent of your DNS provider.