Use the DNS CNAME validation method to verify domain control

Demonstrate control over your domain with a DNS CNAME Record

Check the status of your TLS/SSL certificate order and use the DNS CNAME Record DCV method to demonstrate control over a domain in the order. For more information, see Demonstrate control over domains on your SSL certificate order.

Submitting domains for validation during the order process means certificates will not be issued until domain validation is complete. For immediate certificate issuance, submit domains for prevalidation when possible. See Domain prevalidation: Supported DCV methods.

Demonstrate control over your domain by creating a DNS CNAME record containing a randomly generated token. The CNAME record is used to point token.domain to DigiCert (dcv.digicert.com).

Step 1: Check the status of your pending order

Go to the SSL/TLS certificate's order page to check its issuance status. You can also see what domain and organization validation needs to be completed before we can issue it.

In your CertCentral account, go to the order's Order # details page.
1. In the left main menu, go to Certificate > Orders.
2. On the Orders page, in the Order # column, click the certificate's order number link.

On the Order # details page, in the Order Status section, check the order's issuance status (is the order waiting on domain or organization validation to be completed?).

After validation is complete (domains and organization), the Order status section no longer appears on the Order # details page.

Step 2: Use DNS CNAME to demonstrate control over the domains

On the Order # details page, under You Need To, click the domain link you want to complete the DCV for.

When you have multiple domains (SANs) on an order, each one will be listed. Those with a checkmark next to them are validated. Those with a clock icon next to them still need to be validated.

In the Prove Control Over Domain window, in the DCV Method dropdown, select DNS CNAME Record.

Create the DNS CNAME record
1. In the Token box, copy your unique token. To copy the value to your clipboard, single-click in the text field.
  Note: The unique token expires after 30 days. To generate a new token, click the Generate a New Token link.
2. Go to your DNS provider’s site and create a new CNAME record.
3. In the hostname field (or equivalent), paste the unique token that you copied from your DigiCert account.
4. In the record type field (or equivalent), select CNAME.
5. In the target host field (or equivalent), enter dcv.digicert.com (this points the CNAME record to dcv.digicert.com).
6. Select a Time-to-Live (TTL) value or use your DNS provider’s default value.
7. Save the record.

Verify the DNS CNAME record
1. In your CertCentral account, go to the certificate's Order # details page.
  1. In the left main menu, go to Certificate > Orders.
  2. On the Orders page, in the Order # column, click the certificate's order number link.
2. On the Order # details page, in the Order Status section, under You Need To, locate and click the domain link.
3. In the Prove Control Over Domain window, under 2. Check for Token, click Check.

Step 1: Check the status of your pending order

Step 2: Use DNS CNAME to demonstrate control over the domains

About