Validación previa de dominio: Métodos DCV

Métodos de validación de control de dominio (DCV) compatibles para la validación previa de dominio

Before DigiCert can issue an SSL/TLS certificate, you must demonstrate control over the domains and any SANs (Subject Alternative Names) on the order. We refer to this process as the Domain Control Validation (DCV) process.

DigiCert currently supports these DCV Methods: WHOIS-based Email, Constructed Email, DNS CNAME, DNS TXT, and HTTP Practical Demonstration(also referred to as File or FileAuth).

Industry standards prevent Certificate Authorities (CAs), such as DigiCert, from issuing an SSL/TLS certificate until domain control validation is completed.

CertCentral features a domain prevalidation process that allows you to validate your domains before you begin ordering certificates for them. Completing the domain validation ahead of time allows for quicker certificate issuance. Domain prevalidaiton is required for immediate certificate issuance, see OV/EV certificate immediate issuance.

Demonstrating control over domains on OV/EV TSL certificate orders

When ordering a certificate, you select a DCV method to demonstrate control over the domain on the order. On the certificate's Order details page, use the DCV method selected during the order process to complete the domain validation. You can always switch validation methods if needed. See Demonstrate control over domains on a pending certificate order.

Email DCV method

With this validation method, DigiCert sends two sets of DCV emails: WHOIS-based and Constructed. To demonstrate control over the domain, an email recipient follows the instructions in a confirmation email sent for the domain. The confirmation process consists of visiting the link provided in the email and following the instructions on the page.

See Add a domain, authorize the domain for certificates, and use verification email as the DCV method.

WHOIS-based email DCV method

For the WHOIS-based method, DigiCert sends an authorization email to the registered owners of the public domain as shown in the domain's WHOIS record.

Are you expecting to receive an email at an address published in your domain’s WHOIS record? Please verify that your registrar/WHOIS provider has not masked or removed that information. If they are, find out if they provide a way (such as anonymized email address, web form) for you to allow Certificate Authorities (CAs) to access your domain’s WHOIS data.

Constructed email DCV method

For the Constructed Email method, DigiCert sends the authorization email to five constructed email addresses for the domain: admin, administrator, webmaster, hostmaster, and postmaster @[domain_name].For the Constructed Email method, DigiCert sends the authorization email to five constructed email addresses for the domain: admin, administrator, webmaster, hostmaster, and postmaster @[domain_name].

When you register a domain, you must provide identifying and contact information (e.g., administrative and technical contacts). Instead of using a personal email address, you can use one of the constructed email addresses for your domain (e.g., webmaster@yourdomain.com). Using one of the constructed email addresses allows you to create a "non-expiring" email address that you can add or remove people from when necessary.

If we can't find an MX record for [domain_name], you must use one of the other supported DCV methods to demonstrate your control over the domain.

MX records (mail exchanger records)

Before we can successfully send an authentication email (DCV Email) to the domain owner (or domain controller), we must verify that an MX record (a resource record in the Domain Name System [DNS]) exists in the DNS records of the recipient's domain name. The presence of valid MX records enables us to send the authentication email.

For example, you want to receive your DCV email at one of the constructed email addresses for example.com, admin@example.com. To successfully send a DCV Email to admin@example.com, we must first find an MX record for said address that identifies the server (e.g., mailhost.example.com) set up to receive the emails destined for admin@example.com

If we find an MX record, we can successfully send a DCV email to admin@example.com. If we don't find an MX record, no DCV email is sent because we cannot identify the proper mail server.

DNS CNAME DCV method

Add a DigiCert generated token (provided for the domain in your CertCentral account) to the domain’s DNS as a CNAME record. Then, add dcv.digicert.com as the CNAME target. When DigiCert does a search for a DNS CNAME records associated with the domain, we can find a record that includes the DigiCert verification token.

See Add a domain, authorize the domain for certificates, and use DNS CNAME record as the DCV method.

DNS TXT DCV method

Add a DigiCert generated token (provided for the domain in your CertCentral account) to the domain’s DNS as a TXT record. When DigiCert does a search for DNS TXT records associated with the domain, we can find a record that includes the DigiCert verification token.

See Add a domain, authorize the domain for certificates, and use DNS TXT as the validation method.

HTTP Practical Demonstration DCV method (also referred to as File or FileAuth)

Host a file containing a DigiCert generated random value (provided for the domain in your CertCentral account) at a predetermined location on your website: [your-domain]/.well-known/pki-validation/fileauth.txt. Once the file is created and placed on your site, DigiCert visits the specified URL to confirm the presence of our random value.

See Add a domain, authorize the domain for certificates, and use HTTP practical demonstration as the validation method.