Certificate Management Service:Domain Ownership Verification

DV certificate verification

OV and EV certificate verification

After you submit an OV or EV certificate application, the CA will contact you within approximately one business day (based on the CA's local time zone, excluding holidays). The CA uses the phone number or email address from your company's official registration records — not the contact information you entered during the application.

DNS verification

• Can I change the automatic verification method?

  No. If you need to use a different verification method, purchase the certificate or manage the DNS records through a different Alibaba Cloud account.

• How do I check whether my DNS record has propagated?

  Follow these steps:

  1. In the certificate list, find the certificate with the status Verifying.

  2. Click Verify in Actions column.

  3. Click Verify, if appears No DNS record found., click View Record Value. The system will redirect you to a DNS lookup tool.

  4. Use the DNS lookup tool to check whether the record has propagated.

• The console displays "No DNS record found.". What should I do?

  Common causes and solutions:

  1. The DNS record has not been added.

     See Domain ownership verification and add the required TXT record in your DNS provider's settings.

  2. Console verification delay.

     If you have correctly added the DNS record but the console still reports No DNS record found., this might be due to a verification delay in the console. No action is required. Wait and try again later.

  3. The domain bound to the SSL certificate does not match the domain configured in DNS.

     Note

     If you do not use Alibaba Cloud DNS, go to your DNS provider's console to confirm the domain name.

     1. Confirm that the domain names match.

     2. On the SSL certificate verification page, click Modify, re-enter the domain name, and resubmit your application.

• The console displays "Mismatch found in the DNS record.". What should I do?

  Common causes and solutions:

  1. The DNS record value is configured incorrectly.

     Re-copy host record and value

     

  2. You are using DNSPod or another DNS provider.

     You can ignore the error in the console. After you configure the DNS record correctly at your provider, wait for the CA to complete the verification.

  3. The record value for a DigiCert DV certificate is more than 24 hours old.

     1. Delete the TXT record that is more than 24 hours old.

     2. Go to the Certificate Management Service console, reapply for the certificate, and obtain the latest TXT record value.

     3. Go to your DNS provider's platform and add the new TXT record.

     Note

     The timestamp for GeoTrust DV certificates does not expire.

  4. The record value has not propagated to overseas DNS servers.

     A propagation delay prevents overseas authoritative DNS servers from retrieving the latest TXT record. Check if your dynamic DNS service is running correctly and wait for propagation to complete.

• The console displays "Verification timed out. Try again.". What should I do?

  This indicates a network issue on the site server. Contact your domain service provider to check and resolve any network problems.

• Why does verification fail even though the DNS record has propagated?

  The console verification process may lag behind actual DNS propagation. Wait approximately one minute and try again.

• Verification fails due to a CAA record on the domain.

  Note

  A Certification Authority Authorization (CAA) record is a DNS record type that allows domain owners to specify which CAs are authorized to issue SSL/TLS certificates for their domains. This helps prevent unauthorized certificate issuance.

  • Solution 1: Go to your DNS provider's console (such as the Alibaba Cloud DNS console), find the domain's DNS settings, and delete the CAA record. After the change takes effect, reapply for the certificate.

  • Solution 2: Add the certificate's CA to the CAA record. After the change takes effect, reapply for the certificate.

  Note

  If your domain has a CNAME record pointing to a github.io domain, it inherits the github.io CAA policy, which may interfere with certificate issuance. To resolve this, either temporarily pause the CNAME record before issuing the certificate, or add trust-provider.com, globalsign.com, and sectigo.com to your CAA record.

• My domain's DNS provider is not Alibaba Cloud. How do I configure the DNS verification record?

  Method	Procedure	Benefits
  Configure DNS at your current provider	Log on to your current domain provider's platform and add the TXT verification record that you obtained for the SSL certificate from Alibaba Cloud. Note If you have questions, contact your DNS provider.	Fast and direct. No domain transfer needed.
  Transfer your domain to Alibaba Cloud	Refer to Transfer a domain name to Alibaba Cloud to complete the transfer. Then, configure DNS resolution in the Alibaba Cloud DNS console. Important When you transfer a domain, you must pay for a one-year renewal. The price of the domain transfer is the same as the price of a one-year renewal.	Simplifies future certificate renewals and centralized domain management.

File verification

• The console displays "No file found.". What should I do?

  Common causes and solutions:

  • The verification file was not uploaded to the specified directory. Upload the verification file to the .well-known/pki-validation/ directory on your server. See File verification for detailed steps.

  • Console file verification delay. If you have uploaded the verification file to the correct directory and can access its content at both the HTTPS Address and HTTP Address URLs, but the console still displays The configuration failed. Try again later., this is likely due to a verification delay. No action is needed — wait a few moments and try again.

• The console displays "Verification timed out. Try again.". What should I do?

  Common causes and solutions:

  • Port 80 or 443 is not open on your server.

    The CA verifies file content only through HTTPS Address and HTTP Address(ports 443 and 80).

    • Solution 1: Open port 80 or 443.

    • Solution 2: In the Apply for Certificate, click Cancel Application and change the verification method to Manual DNS Verification.

  • A 301 or 302 redirect is configured.

    • Use the wget -S <URL> command to check whether the verification URL is being redirected. If the response includes HTTP/1.1 301 Moved Permanently or HTTP/1.1 302 Found, a redirect is in place.

      wget -S http://<your_domain>/.well-known/pki-validation/<verification_file_name>

    • Remove the redirect configuration. The following examples show 301 and 302 redirect settings in the Nginx configuration file nginx.conf.

      301 redirect configuration

      server {
          listen 80;
          server_name <your_root_domain> <your_www_subdomain>;
          return 301 <redirect_target>$request_uri;
      }

      302 redirect configuration

      location /.well-known/ {
          return 302 <redirect_target>
      }

  • The server's network security device is using an IP whitelist.

    If your server firewall or security groups restrict access by IP, temporarily add the CA's IP address ranges to the whitelist so the CA can reach your server.

    CA	IP address
    DigiCert	216.168.247.9 64.78.193.238 216.168.249.9
    GlobalSign	211.123.204.251 180.222.177.99 114.179.250.1 114.179.250.2 27.115.18.218

• The console displays "File content is invalid.". What should I do?

  Common causes and solutions:

  • The root domain and www subdomain do not both support access to the .

    Whether you are applying for the root domain (such as aliyundoc.com) or its www subdomain (such as www.aliyundoc.com), the CA checks both hostnames. Ensure the verification file is publicly accessible from both.

    For example, both http://www.aliyundoc.com/.well-known/pki-validation/fileauth.txt and http://aliyundoc.com/.well-known/pki-validation/fileauth.txt must be reachable.

  • The on the web server does not match the latest version.

    In the Verify Information panel, click View Detected File and verify that its content matches the latest . If there is a mismatch, re-download and re-upload the verification file, then verify again. Click View Detected File and compare the Required File with the Detected File in the dialog box.

  • The site has HTTPS enabled, but the verification file is only accessible over HTTP.

    • Solution 1: Deploy the verification file under both the HTTP and HTTPS service paths and ensure the HTTPS endpoint is accessible.

    • Solution 2: Temporarily disable HTTPS on the relevant pages.

  • The site uses a CDN service, but the verification file has not been synced to overseas CDN nodes.

    • Solution 1: Sync the verification file to the overseas CDN nodes, or temporarily disable overseas CDN acceleration.

    • Solution 2: If you cannot modify the CDN nodes, click Cancel Application in Apply for Certificate panel and change the verification method to Manual DNS Verification.

  • The timestamp has expired.

    Download the latest verification file and re-upload it to the web server.