Certificate Management Service:FAQ about domain name ownership verification

The following section describes the common causes of and solutions to this issue:

1. No DNS record is added.

   Solution:

   Manually add a TXT record for your domain name in the system of your DNS service provider to complete the verification. For more information, see Manual DNS verification.

2. Latency exists when DNS record verification is performed in the Certificate Management Service console.

   If you add a valid DNS record but the No DNS record found message appears, latency may exist in the verification process in the Certificate Management Service console.

   Solution:

   Wait a moment and do not perform operations.

3. The domain name bound to the certificate is different from the domain name of the DNS record.

   Note

   If you use a third-party DNS service, contact the service provider to check the domain name.

   Solution:

   1. Check the consistency of the domain names.

   2. In the Verify Information step of the Apply for Certificate panel, click Modify, re-enter the domain name to bind, and then submit the information for verification.

The following section describes the common causes of and solutions to this issue:

1. The DNS record value is incorrectly configured.

   The DNS host record value and TXT record value are incorrectly configured.

   Solution:

   Copy the values of Host Record and Record Value in the Apply for Certificate panel to the DNS record configurations.

   

2. DNSPod or another third-party DNS service is used to resolve domain names.

   DNSPod or another third-party DNS service is used to resolve domain names. In this case, the returned values for domain names that do not exist may differ from the expected values. This may further result in DNS configuration errors.

   Solution:

   Ignore the related error message that appears in the Certificate Management Service console, configure DNS records in DNSPod or the DNS service of another service provider, and wait for the CA to complete the verification. The verification result in the Certificate Management Service console is for reference only. If the verification result is displayed as failed in the console, the verification process of the CA remains unaffected. You must confirm with the CA for the actual verification and issuance results.

3. DNS records of DigiCert DV certificates were generated more than 24 hours ago.

   If you use a DigiCert DV certificate, the record value generated for your domain name is valid only for 24 hours. After 24 hours, the record value is changed. If the latest TXT record value differs from the settings in your DNS service provider, the domain name ownership verification fails.

   Note

   The timestamp of a GeoTrust DV certificate never expires.

   Solution:

   Delete the original TXT record value from the DNS service provider, log on to the Certificate Management Service console, re-apply for the certificate, obtain the latest TXT record value, go to the platform of your DNS service provider, and then add a new TXT record value in the DNS service provider.

   Note

   If you modify an existing TXT record in the domain name control panel of your DNS service provider, the new record requires more than 2 hours to take effect. If you create a TXT record, the record immediately takes effect. To complete the verification, we recommend that you create a TXT record. After the verification is passed, you can delete the TXT record.

4. The TXT record of the domain name is not synchronized to authoritative DNS servers outside China in a timely manner.

   Dynamic resolution is enabled for your domain name, but the TXT record of the domain name is not synchronized to authoritative DNS servers outside China in a timely manner.

   Solution:

   Make sure that dynamic resolution runs as expected and that the authoritative DNS servers can resolve the TXT record.

The following section describes the common causes of and solutions to this issue:

1. A network exception occurs on the DNS server.

   Solution:

   Contact the service provider of the DNS server to check and fix the network exception.

The following section describes the common causes of and solutions to this issue:

1. An exception occurs in the network of the DNS server.

   Solution:

   Contact the service provider of the DNS server to check and fix the network exception.

2. Port 80 or 443 is disabled on the DNS server.

   Solution 1:

   Enable port 80 or 443 on the DNS server.

   Solution 2:

   Go to the Apply for Certificate panel, click Cancel Application, and then change the value of the Domain Verification Method parameter to Manual DNS Verification.

3. The website for the domain name does not support access from regions outside China.

   If you apply for a certificate from an international brand, such as DigiCert or GlobalSign, but the website for the domain name bound to the certificate does not support access from IP addresses outside China, the CA cannot perform file verification.

   Solution:

   1. Use a tool of domain name ownership verification to filter out domain names of websites that do not support access from IP addresses outside China.

   2. Temporarily add the IP address of the CA to the whitelist of your DNS server to allow the CA to access the DNS server and complete domain name ownership verification. For more information about how to obtain the IP address of a CA, contact your account manager.

      Note

      After the certificate is issued, we recommend that you remove the IP address of the CA from the whitelist to prevent unknown issues from occurring when you apply for another certificate.

4. The domain names bound to an individual test certificate contain sensitive keywords.

   If the domain names that you bind to an individual test certificate contain sensitive keywords, such as edu, gov, org, jp, pay, bank, live, and nuclear, the certificate may fail to be issued.

   Solution:

   Purchase an OV or EV certificate, or a vTrus certificate. vTrus is a Chinese certificate brand.

The following section describes the common causes of and solutions to this issue:

1. An old verification file exists on the DNS server.

   Solution:

   1. In the Apply for Certificate panel, click View Detected File and record the information about the detected file.

   2. Log on to your DNS server and delete the detected file.

      In most cases, the detected file is stored in the Web root directory/.well-known/pki-validation directory.

   3. Download and re-upload the verification file to the DNS server. For more information, see File verification.

2. The fileauth.txt file is not reachable over an HTTPS URL.

   HTTPS is enabled for specific website pages, but the fileauth.txt verification file is reachable only over an HTTP URL.

   Solution 1:

   Make sure that the verification file is reachable over both HTTP and HTTPS URLs.

   Solution 2:

   Temporarily disable HTTPS for affected pages.

3. The URL of the verification file is redirected.

   The 301 or 302 redirect is enabled for the HTTPS Address and HTTP Address that are used to access the verification file.

   Solution:

   1. Check whether a redirect is enabled for the URLs of the verification file.

      • You can run the wget -S URL command to check whether a redirect is enabled.

      • You can check whether a redirect is enabled based on the address changes in the address bar of your browser.

   2. Cancel the related settings to disable the redirect.

4. Alibaba Cloud CDN is activated. However, the verification file is not synchronized to CDN nodes outside China.

   Solution 1:

   Synchronize the verification file to the CDN nodes outside the Chinese mainland, or temporarily disable CDN acceleration for regions outside the Chinese mainland.

   Solution 2:

   If you cannot perform a change operation on the server on which a CDN node resides, go to the Apply for Certificate panel, click Cancel Application, and then change the value of the Domain Verification Method parameter to Manual DNS Verification.

5. The timestamp of the validation file expires.

   Solution:

   Log on to the Certificate Management Service console, download the latest verification file, and then upload the file to the specified directory of your website.

No, wildcard domain names do not support file verification. For more information, see [Notice] File Verification is no longer supported when you apply for wildcard certificates.