Skip to content
Client area

SSL certificate validation process

Before a certificate is issued, the certification authority has to be sure the domain belongs to the customer. That check is called domain control validation (DCV), and without it no certificate is issued. Every certificate we sell is validated this way only: no paper documents, no faxes, no phone calls.

This page describes the procedure in force on 17 September 2026 for Sectigo and RapidSSL certificates.

What the authority actually checks

It checks control over the domain, not the identity of its owner: the authority makes sure the customer runs the domain — its mail, its website or its DNS zone. Such a certificate carries no company details, and it should not.

A regular certificate is issued for the site name and its www version; a Wildcard covers the domain and all its first-level subdomains. Only the main domain is validated — you do not confirm each subdomain separately.

Three ways to prove the domain is yours

You pick the method when you order. All three are equal to the authority — the difference is only in what you have access to.

An email to a role address

The authority sends an email to one of the role addresses on your domain: admin@, administrator@, hostmaster@, postmaster@, webmaster@. The message contains a link and a validation code: follow the link, enter the code, and the domain is confirmed.

This fits when the domain has a mailbox you actually read. The email used to go to the Whois contact, which is why customers were told to unhide their Whois data; today the address is set by a separate _validation-contactemail DNS record, and hidden Whois no longer gets in the way.

A file on the website

The authority gives you a file name and its contents; the file goes into the .well-known/pki-validation/ directory in the document root. The validation robot comes to the domain on port 80 or 443 and reads it.

This fits when the site already works and you can put a file into it. It does not work for a Wildcard — that is an industry rule, not a setting of a particular authority.

A DNS record

The authority gives you a CNAME or TXT record to add to the domain zone. Neither a website nor mail is needed — access to DNS is enough.

This is the one method that always works: the domain may have no site yet, and the certificate may be destined for a router or an internal service. For a Wildcard, DNS validation is the main route.

How long it takes

The email arrives within minutes. The file is checked as soon as you upload it. A DNS record works once it propagates: usually minutes, though it depends on the zone TTL and the provider. After a successful check the certificate is issued automatically, also within minutes.

Why validation has to be repeated

The lifetime of public TLS certificates is being shortened on a schedule adopted by the CA/Browser Forum (ballot SC-081v3). The first step is already in force:

  • from 15 March 2026 — a certificate lasts no longer than 200 days, and the result of domain validation is valid for the same 200 days;
  • from 15 March 2027 — 100 days and 100 days;
  • from 15 March 2029 — 47 days for the certificate and 10 days for domain validation.

Hence the practical consequence: the service is ordered for a year, but the certificate file changes twice within it. While the previous validation is still current, reissuing happens without you; once it expires, the domain has to be confirmed again.

If you have no permanent access to mail on the domain, validate it with a DNS record and leave that record in the zone. Then the repeat check will pass on its own.

If validation fails

  • A CAA record. If the domain zone has CAA records, they must permit the right authority: sectigo.com for Sectigo certificates, digicert.com for RapidSSL. Otherwise issuance is refused no matter how you proved the domain.
  • The email never arrived. The role mailbox does not exist, the message went to spam, or you chose an address the domain does not have.
  • The file cannot be read. The path has to be exact down to the last character, the file name unchanged, and the domain must not send the robot off to another domain by redirect.
  • The DNS record is not visible. It has not propagated, it was added to the wrong host, or it was copied with stray quotes and spaces.
  • The domain was just registered or changed hands. Zone data may not have caught up yet — try the check again later.

Organisation validation and extended validation

Besides domain validation there are organisation validation (OV) and extended validation (EV): company documents and a verification call are added to the domain check, and issuance takes several business days. We do not sell those certificates.

There has been no visible benefit to them for years: browsers dropped the green bar with the company name back in 2019 — Chrome in version 77, Firefox in version 70. The organisation name now lives only in the certificate details, where no visitor looks. Encryption, compatibility and reliability do not depend on the validation type at all.

If you need such a certificate because a counterparty or a regulator asks for it, write to us and we will discuss what we can do.