Skip to main content

Domain locking

Use CertCentral domain locking to limit which of your Company's CertCentral accounts can issue certificates for your domains.

Before you begin

To lock a domain, you need a Certification Authority Authorization (CAA) resource record for your domain. If you are unfamiliar with CAA resource records, contact your registrar for details on how to create and update a CAA resource record.

Enable domain locking for your account

  1. In your CertCentral account, in the left main menu, go to Settings > Preferences.

  2. On the Preferences page, expand Advanced Settings.

  3. In the Domain lock section, check Enable domain lock for this account.

  4. At the bottom of the page, select Save Settings.

You can now lock domains so only users in your account can get certificates for them.

Locking a domain

  1. In your CertCentral account, in the left main menu, go to Certificates > Domains.

  2. On the Domains page, select the domain that you want to lock.

  3. Scroll down to the Domain lock section on the page. Select the toggle, to move it from Disabled to Pending.

  4. Copy the unique verification token.

  5. Access your registrar's CAA resource record.

  6. In your domain's CAA resource record, put the unique verification token in the record and save the updated record.

    • Example of where to place the token in the CAA resource record:

      • Value: digicert.com; account=fce9431ca2df7ae0d25a6de09587fdc1ff1616e7187655a18eb72723a0b85c86

      • "digicert.com" is the value for the CA that you authorize to issue your certificates.

      • fce9431ca2df7ae0d25a6de09587fdc1ff1616e7187655a18eb72723a0b85c86" is the DigiCert generated random value token that you got from your CertCentral account.

      • "account=" must be included in front of the random value.

  7. Once the CAA resource record is ready, go to the domain's details page in CertCentral and select Check CAA. The toggle switches to Enabled when the lock is successful.

What's next

You locked the domain. Only users in your account can get certificates for this domain. If you want another account to order certificates for this domain, add their unique verification token to the CAA resource record.

Note

If the domain validation expires, the domain goes from locked to pending. To relock the domain, revalidate the domain.

In this section: