筛选方式: HTTP Practical Demonstration x 清除
compliance

Industry changes to file-based DCV (HTTP Practical Demonstration, file auth, file, HTTP token, and HTTP auth)

To comply with new industry standards for the file-based domain control validation (DCV) method, you can only use the file-based DCV to demonstrate control over fully qualified domain names (FQDNs), exactly as named.

To learn more about the industry change, see Domain validation policy changes in 2021.

How does this affect me?

As of November 16, 2021, you must use one of the other supported DCV methods, such as Email, DNS TXT, and CNAME, to:

  • Validate wildcard domains (*.example.com)
  • To include subdomains in the domain validation when validating the higher-level domain. For example, if you want to cover www.example.com, when you validate the higher-level domain, example.com.
  • Prevalidate entire domains and subdomains.

To learn more about the supported DCV method for DV, OV, and EV certificate requests:

compliance

CertCentral: Pending certificate requests and domain prevalidation using file-based DCV

Pending certificate request

If you have a pending certificate request with incomplete file-based DCV checks, you may need to switch DCV methods* or use the file-based DCV method to demonstrate control over every fully qualified domain name, exactly as named, on the request.

*Note: For certificate requests with incomplete file-based DCV checks for wildcard domains, you must use a different DCV method.

To learn more about the supported DCV methods for DV, OV, and EV certificate requests:

Domain prevalidation

If you plan to use the file-based DCV method to prevalidate an entire domain or entire subdomain, you must use a different DCV method.

To learn more about the supported DCV methods for domain prevalidation, see Supported domain control validation (DCV) methods for domain prevalidation.

compliance

CertCentral Services API

If you use the CertCentral Services API to order certificates or submit domains for prevalidation using file-based DCV (http-token), this change may affect your API integrations. To learn more, visit File-based domain control validation (http-token).

enhancement

CertCentral:自动 DCV 检查 - DCV 轮询

我们很高兴宣布,我们改进了域控制验证 (DCV) 流程,并针对 DNS TXT、DNS CNAME 和 HTTP 实用演示 (FileAuth) DCV 方法新增了自动检查。

这意味着,将 fileauth.txt 文件放置在域上或在 DNS TXT 或 DNS CNAME 记录中添加随机值后,您无需登录 CertCentral 自行进行检查。我们将自动运行 DCV 检查。但是,如有需要,您仍然可以手动进行检查。

DCV 轮询频率

提交公共 SSL/TLS 证书订单、提交域进行预验证或更改域的 DCV 方法后,将立即启动 DCV 轮询并运行一周。

  • 间隔 1 - 前 15 分钟每分钟一次
  • 间隔 2 - 每 5 分钟一次,持续 1 小时
  • 间隔 3 - 每 15 分钟一次,持续 4 小时
  • 间隔 4 - 每小时一次,持续 1 天
  • 间隔 5 - 每 4 小时一次,持续 1 周*

*间隔 5 结束后停止检查。如果在第一周结束后还未将 fileauth.txt 文件放置在域上或在 DNS TXT 或 DNS CNAME 记录中添加随机值,则需要您自行进行检查。

有关支持的 DCV 方法的更多信息:

compliance

行业标准变更

从 2019 年 7 月 31 日 (19:30 UTC) 开始,您必须使用 HTTP 实用演示 DCV 方法演示对证书订单上的 IP 地址的控制权。

有关 HTTP 实用演示 DCV 方法的更多信息,请参阅这些说明:

行业标准过去允许使用其他 DCV 方法证明对 IP 地址的控制权。但是,随着投票 SC7 的通过,IP 地址验证法规已更改。

投票 SC7:更新 IP 地址验证方法

该投票重新定义了验证客户对证书中所列 IP 地址控制权的允许流程和程序。投票 SC7 合规性更改从 2019 年 7 月 31 日 (19:30 UTC) 开始生效。

为了保持合规,从 2019 年 7 月 31 日 (19:30 UTC) 开始,DigiCert 仅允许客户使用 HTTP 实用演示 DCV 方法验证 IP 地址。

移除对 IPv6 的支持

从 2019 年 7 月 31 日 (19:30 UTC) 开始,DigiCert 移除了对 IPv6 地址证书的支持。由于服务器限制,DigiCert 无法连接到 IPv6 地址以验证在客户的 HTTP 实用演示 DCV 方法网站上放置的文件。