SSL Certificate email-based Domain Validation

Table of Contents

• The process
• Email requirements
• WHOIS email deprecation
• Email validation and GDPR
• Select the validation email address
• Change the validation email address
• Resend the validation email
• Have more questions?

To issue an SSL certificate, the Certificate Authority has to validate the authenticity of the certificate order to ensure the request is legitimate and comes from an authorized owner of the domain. This process is called domain validation.

The goal of validation is to ensure the authenticity of a certificate order before issuing a new certificate. Specifically, before issuing the certificate, the Certificate Authority must be sure the domain listed in the certificate is registered and someone with admin rights is aware of and approves the certificate request.

Email-based domain validation is the most common certificate validation mechanism for domain-validated certificate orders. The certificate authority compiles a list of administrative emails associated with the domain, using common administrative email addresses (e.g. admin@ or webmaster@).

The domain validation is a mandatory step. The Certificate Authority will not issue the certificate if the order has not been validated.

The process

The email validation process consists of a few steps:

1. When you purchase a certificate, we show you a list of authoritative emails identified by the Certificate Authority for the domain associated with the certificate
2. You select an email from the list.
3. The Certificate Authority sends a verification email (also called DCV email) to the recipient with a unique link to approve the certificate and validate your domain ownership.
4. You click on the link to validate and approve the certificate. At this point the certificate’s authenticity is validated and the authority will generate it.

Email requirements

The approval email cannot be an arbitrary email such as a customer-provided email or the email in your DNSimple account.

The approval email typically can be sent to the following addresses, called administrative emails:

• admin@example.com
• administrator@example.com
• hostmaster@example.com
• postmaster@example.com
• webmaster@example.com

Where example.com is the domain for the certificate being purchased.

WHOIS email deprecation

Due to security vulnerabilities and evolving privacy standards, the CA/Browser Forum introduced Ballot SC-80v3, requiring the phase-out of WHOIS email addresses for Domain Control Validation (DCV).

You must use one of the administrative email addresses (admin@, webmaster@, etc.) at the domain being validated. Email addresses from WHOIS records, including registrant, administrative, or technical contact emails, cannot be used for certificate validation.

Email validation and GDPR

Due to the privacy rules enacted by GDPR on May 25th 2018, most registrars hide or mask email addresses in WHOIS records. Combined with the WHOIS email deprecation requirements, this means you must use one of the administrative email addresses provided by the Certificate Authority for validation.

Select the validation email address

You select the validation email when you purchase the certificate. You can use one of the emails available in the list displayed in the configuration page, selected by the Certificate Authority and based upon the constraints documented above. What if the validation email you want to use is not included in this list?

If the approver is not in this list or you need time to configure one of those emails, you can also close this page and come back later.

Change the validation email address

If you selected an incorrect email recipient, you can request the email to be changed as long as the email address meets the requirements described above.

The certificate must be in the submitted state. If instead you still need to submit the certificate and the email address you want to use doesn’t show up in the list, then follow the instructions to select a different email.

Resend the validation email

If you haven’t received the validation email, for example because the email configuration was incorrect at the time of the submission, you can request the email to be resent.

Have more questions?

If you have additional questions or need any assistance with multi-account management, just contact support, and we’ll be happy to help.