CertCentral: DNS CNAME DCV method now available for DV certificate orders
In CertCentral and the CertCentral Services API, you can now use the DNS CNAME domain control validation (DCV) method to validate the domains on your DV certificate order.
Note: Before, you could only use the DNS CNAME DCV method to validate the domains on OV and EV certificate orders and when prevalidating domains.
To use the DNS CNAME DCV method on your DV certificate order:
Note: The AuthKey process for generating request tokens for immediate DV certificate issuance does not support the DNS CNAME DCV method. However, you can use the File Auth (http‑token) and DNS TXT (dns‑txt‑token) DCV methods. To learn more, visit DV certificate immediate issuance.
To learn more about using the DNS CNAME DCV method:
CertCentral Services API: Improved List domains endpoint response
To make it easier to find information about the domain control validation (DCV) status for domains in your CertCentral account, we added these response parameters to domain objects in the List domains API response:
dcv_approval_datetime
: Completion date and time of the most recent DCV check for the domain.last_submitted_datetime
: Date and time the domain was last submitted for validation.For more information, see the reference documentation for the List domains endpoint.
Industry changes to file-based DCV (HTTP Practical Demonstration, file auth, file, HTTP token, and HTTP auth)
To comply with new industry standards for the file-based domain control validation (DCV) method, you can only use the file-based DCV to demonstrate control over fully qualified domain names (FQDNs), exactly as named.
To learn more about the industry change, see Domain validation policy changes in 2021.
How does this affect me?
As of November 16, 2021, you must use one of the other supported DCV methods, such as Email, DNS TXT, and CNAME, to:
To learn more about the supported DCV method for DV, OV, and EV certificate requests:
CertCentral: Pending certificate requests and domain prevalidation using file-based DCV
Pending certificate request
If you have a pending certificate request with incomplete file-based DCV checks, you may need to switch DCV methods* or use the file-based DCV method to demonstrate control over every fully qualified domain name, exactly as named, on the request.
*Note: For certificate requests with incomplete file-based DCV checks for wildcard domains, you must use a different DCV method.
To learn more about the supported DCV methods for DV, OV, and EV certificate requests:
Domain prevalidation
If you plan to use the file-based DCV method to prevalidate an entire domain or entire subdomain, you must use a different DCV method.
To learn more about the supported DCV methods for domain prevalidation, see Supported domain control validation (DCV) methods for domain prevalidation.
CertCentral Services API
If you use the CertCentral Services API to order certificates or submit domains for prevalidation using file-based DCV (http-token), this change may affect your API integrations. To learn more, visit File-based domain control validation (http-token).
業界標準變更
2019 年 7 月 31 日 (UTC 時間 19:30),您必須使用 HTTP 現實論證 DCV 方法,證明有您的憑證訂單上的 IP 位址的控制權。
如需更多有關 HTTP 現實論證 DCV 方法的資訊,請參閱這些指示:
目前,所使用的業界標準允許您使用其他 DCV 方法,證明有您的 IP 位址的控制權。但在通過 Ballot SC7 後,IP 位址驗證的法規已變更。
此次投票重新定義了驗證客戶對憑證中所列的 IP 位址的控制權的流程和程序。Ballot SC7 的遵規變更在 2019 年 7 月 31 日 (UTC 時間 19:30) 生效。
若要保持相容,在 2019 年 7 月 31 日 (UTC 時間 19:30),DigiCert 僅允許客戶使用 HTTP 現實論證 DCV 方法驗證他們的 IP 位址。
移除對 IPv6 的支援
2019 年 7 月 31 日 (UTC 時間 19:30),DigiCert 已移除對 IPv6 位址的憑證支援。由於伺服器的限制,DigiCert 無法連線到 IPv6 位址,以確認放置在客戶網站的檔案是否適用 HTTP 現實論證 DCV 方法。