SSL certificates
Domain validation for a certificate
How to prove the domain is yours: a DNS record, a file on the site or an email. Automatic record for domains on ZRAZU DNS and in Cloudflare, common errors.
Before issuing a certificate, the certificate authority checks that the domain really is yours. This is called DCV. You choose the method when ordering, and you can change it later in the certificate card.
For Multi-domain each name is confirmed separately, and you can choose a method for each one.
Three methods
| Method | What to do | When it fits |
|---|---|---|
| DNS record | Add a record (TXT or CNAME) where you manage the domain DNS | The most reliable. No site needed, works for wildcard too |
| File on the site | Put a small text file at the address the cabinet shows (http or https) | You have a working site and access to its files. Not for wildcard |
| Open the link in the email from the authority | Nothing to set up, but the domain must have mail (MX) |
For email, the authority uses one of the standard addresses of the domain: admin@, administrator@, webmaster@, hostmaster@ or postmaster@. The cabinet lets you pick a mailbox on the name itself or on the domain above it, but not on a zone such as com.ua.
Confirming with a DNS record
- Open the certificate card: cabinet. In the block “Validate the domain” the cabinet shows the type, name and value of the record.
- Add this record to the domain DNS where you manage it: at ZRAZU, in Cloudflare or at another provider.
- Click “Check now”. The authority also checks on its own, and the card updates in a minute or two.
The validation data does not appear at once: the authority prepares it for a few minutes, and the page updates itself. The “Check now” button works no more than once a minute.
After issuance, do not delete the record or file: with them the next parts of the subscription are issued on their own.
Domain on ZRAZU DNS or in Cloudflare
If the domain is on our name servers, the cabinet offers “Add the record automatically”. We add only the validation record to the zone and immediately ask the authority to check the domain. Other records are not changed.
The same applies to a domain in your Cloudflare, if a Cloudflare key with permission to change DNS has been added under “Team → Cloudflare”. We will place only the validation record.
The validation record allows a certificate to be issued for the domain, so the cabinet may ask you to confirm your sign-in again, and it emails the organization owners about the added record.
File on the site
- In the card, copy the file address and its content, or click “Download the file”.
- Put the file on the site at exactly this address. It must open without a redirect.
- Click “Check now”.
- Open the email from the authority at the chosen domain address.
- Follow the link in the email and confirm the domain.
No email? Check spam. The card has the buttons “Send again” and “Change the mailbox or method”: an email can be sent no more than once every 2 minutes, with up to 20 changes and emails per day.
Changing the method
If the chosen method does not fit, click “Change the method” in the card, choose another and click “Apply”. We pass your choice to the authority, and the new data appears in a minute or two.
If it didn't work
- “The domain is not confirmed yet — we will check again”. DNS records do not update instantly. Wait and click “Check now” again.
- “The authority was just asked — try in a minute”. This is the check limit: one request per minute.
- Cloudflare: “the zone of this domain is not in the key’s account”. Place the record manually or add the domain to the key’s account.
- Cloudflare: the key lacks permission to change DNS. Update the key or place the record manually.
- CAA does not allow the authority. The domain has a CAA record that does not include our certificate authority. Add the permission in CAA or remove the restriction. In a bulk order the “Check CAA” button shows this in advance.
- The domain has no mail. The email method needs MX. Choose DNS or a file.
- Not confirmed within 25 days. The order is closed and the payment is returned to the balance.