Filtering by: CanSignHttpExchanges x clear

Industry standard requirements for including the CanSignHttpExchanges extension in an ECC SSL/TLS certificate:

  • CAA resource record for the domain that includes the "cansignhttpexchanges=yes" parameter*
  • Elliptic Curve Cryptography (ECC) keypair
  • CanSignHttpExchanges extension
  • Maximum 90-day validity*
  • Only used for the Signed HTTP Exchange

*Note: These requirements took effect as of May 1, 2019. The Signed HTTP Exchanges extension is under active development. There may be additional changes to the requirements as industry development continues.

The 90-day maximum certificate validity requirement doesn't affect certificates issued prior to May 1, 2019. Note that reissued certificate will be truncated to 90-days from the time of reissue. However, you can continue reissuing the certificate for the full purchased validity period.

CanSignHttpExchanges extension

Recently, we added a new certificate profile, HTTP Signed Exchanges to help address the AMP URL display issue where your brand isn’t displayed in the address bar. See, Display better AMP URLs with Signed Exchanges.

This new profile allows you to include the CanSignHttpExchanges extension in OV and EV SSL/TLS certificates. Once enabled for your account, the Include the CanSignHttpExchanges extension in the certificate option appears on your OV and EV SSL/TLS certificate order forms under Additional Certificate Options. See Get your Signed HTTP Exchanges certificate.

To enable this certificate profile for your account, please contact your account manager or contact our Support team.