Certificate Management Service:What is an SSL certificate?

Certificate issuance and verification (trust chain construction)

1. Generate a request: The server generates a key pair (2048-bit RSA or 256-bit ECC) and packages the public key and organization information into a Certificate Signing Request (CSR).

2. Sign by the CA: After the CA verifies domain ownership, it extracts the public key and applicant information from the CSR. The CA then creates the certificate content, which includes issuer information, a validity period, and extension fields. The CA uses its private key to digitally sign the content, which generates an X.509 standard certificate.

3. Propagate trust: The browser verifies the server certificate signature step-by-step using pre-installed root certificates to establish a trust chain.

Encrypted session establishment (TLS handshake)

1. Initiate the handshake: The client sends a ClientHello message that includes the supported protocol versions and a list of cipher suites.

2. Transmit the certificate: The server responds with a ServerHello message and sends its certificate chain.

3. Verify identity: The client verifies the certificate's validity period and that the domain name matches. It also confirms that the certificate is not revoked using a certificate revocation list (CRL) or the Online Certificate Status Protocol (OCSP). Some deployments use the OCSP Stapling feature to optimize this process.

4. Exchange keys: Both parties generate a session key through a key exchange mechanism.

   • ECDHE mode (recommended): Both parties generate temporary key pairs, exchange public keys, and independently calculate the same session key.

   • RSA mode (legacy): The client generates a pre-master key, encrypts it with the server's public key, and then sends it. After the server decrypts the key, both parties derive the session key.

5. Communicate symmetrically: After the handshake is complete, all data is transmitted using the session key for symmetric encryption.

Purchase a certificate

1. Select a certificate type based on your needs. For more information, see SSL certificate selection guide.

2. Fill in the purchase information. For more information, see Purchase an official certificate.

Create a certificate

If you did not associate a domain name with your quota during purchase, you must create a certificate to complete the association. During this process, the Quick Issue option is available:

• Select Quick Issue: You must provide the application information. The system then automatically submits a certificate application to the CA. You only need to complete the domain name ownership verification.

• If you do not select Quick Issue, you must log on to the Certificate Service console to manually fill in and submit an application after the certificate is created. For more information, see Submit an application to a CA.

Apply for a certificate

1. Submit an application to a certificate authority (CA)

   Fill in the required information based on the certificate type. This information may include the domain name or IP address to be bound, contact details, company information, and a business license. Then, submit the certificate application to the CA. For more information, see Apply for a certificate.

2. Domain name ownership verification

   When you submit an application to the CA, you must verify your ownership of the domain name. For more information, see Domain name ownership verification.

   • DV (Domain Validated) certificates support three verification methods: Automatic DNS Verification, Manual DNS Verification, and File Verification.

   • For EV or OV certificates, you must complete the verification based on the content of the domain name verification email sent by the CA.

3. CA review

   After you submit the application and complete the domain name ownership verification, you must wait for the CA to review your application. To view the review progress and result, see Handle CA review results. The average issuance time for a domain validated (DV) certificate is 1 to 15 minutes. The average issuance time for an organization validated (OV) or extended validation (EV) certificate is 5 calendar days.

Deploy the certificate

After the CA approves your application and the certificate status changes to Issued, you can deploy the certificate file to your web server, such as Nginx, Apache, or IIS, or to a cloud service. This enables the HTTPS feature for your site. For more information, see Deploy an SSL certificate.

What to do next

What do I do if I cannot find my certificate after purchase?

If you did not enter domain name information during the purchase, you receive a certificate creation quota instead of a certificate that is displayed in the certificate list. You must create an SSL certificate and bind a domain name to it before it appears in the list.

Do SSL certificates support Chinese domain names?

Yes, they do. If you bind a Chinese domain name, you must convert it to Punycode as prompted in the console before you can apply for a certificate. You can also use a transcoding tool to perform the conversion. For more information, see Convert a Chinese domain name.

Can I apply for an Alibaba Cloud SSL Certificate if my DNS provider is not Alibaba Cloud?

Yes, you can. You only need to complete the domain ownership validation. This is independent of your DNS provider.