Ordering and activating a certificate

An owner, administrator or accountant of the organization can order a certificate. You can pay from the balance, by card or by IBAN invoice — the same as any other order.

We never receive the private key: we only need the CSR, the request for a certificate. The key stays with you.

What a CSR is and where to get one

A CSR is a text request that starts with -----BEGIN CERTIFICATE REQUEST-----. It is created together with the private key. There are two ways.

Create it in the cabinet. In the order form, find the section “No CSR? Create one here”. Choose the key type: RSA (“any server”) or EC (“smaller and faster, modern servers”), then click “Create the key and CSR”. The key and the request are created in your browser and never reach us. Be sure to click “Download the private key” and keep the file: without it the certificate cannot be installed, and we cannot recover the key.

Create it on your server. For example with openssl:

openssl req -new -newkey rsa:2048 -nodes -keyout kava.key -out kava.csr -subj "/CN=kava.com.ua"

The file kava.key stays with you; paste the contents of kava.csr into the form.

CSR requirements: an RSA key of 2048 bits or more, or EC P-256 or P-384; your domain must be in the request; it may contain only domain names (no IPs, emails or links).

How to order

1. In the cabinet open “SSL certificates” and click “Order SSL” (cabinet).
2. Choose the payer: “LLC, with VAT” or “Sole proprietor, no VAT”.
3. Choose the certificate. The form shows the price per year at once.
4. Enter the domain, for example kava.com.ua. The www. address is included automatically.
5. For Multi-domain, add the other names, one per line. The form shows how many names are included in the price and how many more you can buy. Wildcard names (*.domain) are not available in every certificate.
6. Choose how to confirm the domain. Details: Domain validation.
7. Paste the CSR or create it here.
8. Click “Go to payment” and choose how to pay: from the balance, by card or with an invoice (IBAN transfer). For an invoice, choose the payer — the company or sole proprietor it is issued to. A transfer by invoice pays the order automatically once the bank clears it.

After payment you only need to confirm the domain. The certificate appears in its card, and we email you when it is issued.

Pay now, activate later

Some orders are paid first without a domain. They appear in the list with the status “Awaiting activation” and the date “Activate by …”.

1. In the certificate list click “Activate”.
2. The domain and certificate names are already paid for and cannot be changed here. Create or paste the CSR and choose the validation method.
3. Click “Activate”.

The certificate year counts from activation. You do not pay again. If you change your mind, you can refuse before activation and get the amount back: to the balance or, on your request, to the card. If the activation period has passed, write to us and we will return the amount.

Several certificates in one order

If you have many domains, order up to 50 certificates together: one per domain, under one order number. Each domain needs its own CSR. The “Check CAA” button shows in advance whether the CAA record of your domain forbids issuance by our certificate authority. The whole batch is paid as one order, in any way.

If it didn't work

• “This is a private key, not a CSR”. You pasted the key. Never send a key to anyone; only the CSR text is needed.
• “This does not look like a CSR”. Copy the whole text, including the BEGIN and END lines.
• “The CSR was made not for …”. The domain in the request does not match the order domain. Create the CSR again.
• “The RSA key is shorter than 2048 bits”. Create a longer key.
• “Too many names for this certificate”. Remove the extra names or choose another certificate.
• Wildcard and a file on the site. A wildcard name cannot be confirmed with a file: choose a DNS record or an email.
• “Too many orders”. There is an hourly limit on orders. Try later.
• The authority did not accept the order. We return the money to the balance; the reason is shown in the card.
• The domain was not confirmed within 25 days. The order is closed and the payment is returned.