Before any SSL certificate is issued, the CA must confirm you control the domain. You do this by adding a DNS record, publishing a file or approving an email, and the CA checks the result from several network locations. SSL Store defaults to DNS and shows you exactly what to add.
DNS validation (recommended)
You add a small DNS record to your domain: a CNAME (Sectigo, Comodo, PositiveSSL) or TXT (DigiCert, GeoTrust, Thawte, RapidSSL) record we generate for you. It works for wildcard certificates, doesn't depend on your web server, and can stay in place for the next validation. It is our default.
HTTP file validation
You upload a small text file we provide to http://yourdomain.in/.well-known/pki-validation/. Good if you can't edit DNS but can publish files. Two limits: it can't be used for wildcard certificates, and it validates only the exact domain, not its subdomains.
Email validation
The CA emails a link to a constructed address on your domain: admin@, administrator@, hostmaster@, postmaster@ or webmaster@. Industry rules are moving away from email validation, so we offer it only as a fallback. Use DNS where you can.
The 2025–2029 validation rules
- Checks from several locations. Since 2025, CAs must confirm domain control (and CAA) from several network locations around the world. The record or file must answer the same everywhere: geo-DNS, geo-blocking or an IP allow-list can make validation fail.
- CAA records. CAA records are optional. If your domain (or a parent domain) has any, they must allow the CA:
sectigo.comfor Sectigo, Comodo and PositiveSSL, ordigicert.comfor DigiCert, GeoTrust, Thawte and RapidSSL. Otherwise the CA must refuse to issue. - DNSSEC. CAs check DNSSEC signatures during these lookups. If your domain has misconfigured DNSSEC, validation (and issuance) fails until it's fixed. If you don't use DNSSEC at all, nothing changes.
- Validation reuse. Under CA/Browser Forum ballot SC-081, a completed domain check can be reused only for a limited time, after which the domain is checked again at your next reactivation or reissue:
| Certificates issued | A domain check can be reused for up to |
|---|---|
| Since 15 Mar 2026 (now) | 200 days |
| From 15 Mar 2027 | 100 days |
| From 15 Mar 2029 | 10 days |
Which method should you use?
Use DNS unless you can't edit your DNS zone, in which case use the HTTP file method. Leave the record or file in place until the certificate is issued; if you remove it too early, validation can fail. Ready to set up? See how to activate your certificate.
Common questions
How long does a validation last?
Up to 200 days today. From 15 Mar 2027, up to 100 days. After that, you validate again at the next reactivation or reissue. Keeping a DNS record in place makes this painless.
My record is live but validation still fails. Why?
Usually DNS caching or propagation, a CAA record that doesn't list the CA, broken DNSSEC, or a firewall or geo-DNS setup that answers differently in some regions.
Do I need to add a CAA record?
No. CAA is optional. It only matters if your domain already has CAA records; then one of them must allow the CA.
Not sure your record is live yet? Check it, and your CAA records, with the DNS, DCV & CAA Checker.