About Authorized Domains¶
Some certificate authorities show which domains you've registered with them, along with the current Domain Control Validation (DCV) status of each one. When a CA supports this, Certificate Manager - SaaS shows this information in two places.
- The Domains tab on the Certificate Authorities page lists the domains from all your CA accounts in one table.
- The Authorized Domains table on a CA account's details drawer lists the domains for that CA account only.
Because the CA's list of authorized domains determines which certificates you can request, these tables help you find domains that need attention before a validation failure blocks certificate issuance.
View domains across all CAs¶
- Sign in to Certificate Manager - SaaS.
- Click Integrations > Certificate Authorities.
- Click the Domains tab.
Each row represents a domain registered with one of your CA accounts.
| Column | Description |
|---|---|
| Domain Name | The domain name registered with the CA. |
| Validation Status | Where the domain is in the DCV process. See Validation status values. |
| Validation Method | The DCV method used to validate the domain. See Validation method values. |
| Expiration Date | The date when the current validation for this domain expires. |
| CA Type | The type of CA that reports the domain, such as DigiCert or GlobalSign MSSL. Domains from CA Connector Framework CAs, such as Sectigo Certificate Manager, show Connector CA. Domains from HID PKIaaS show Zero Touch PKI. To find the domains from one CA account, filter on CA Name. |
| CA Name | The CA account that reports the domain. Click the name to open that CA account's details drawer. |
| Last Synced | When Certificate Manager - SaaS last updated the domain's information from the CA. |
When the information updates¶
Certificate Manager - SaaS updates the Domains tab from each CA account once a day. To get the latest information for one CA account sooner, open its details drawer. Certificate Manager - SaaS checks the CA when the drawer opens and updates that CA account's rows in the Domains tab.
If Certificate Manager - SaaS can't get a CA account's domains during an update, it keeps that CA account's existing rows and tries again at the next update. The Last Synced column shows when each row was last updated.
Find domains that need attention¶
Use the toolbar above the table to narrow the list.
- Search matches text in the domain name.
- Filters lets you filter on any column. Text columns use contains, Validation Status and CA Type use is, and date columns use is between. Some CAs report methods in their own terms, so to filter by Validation Method, enter the term your CA uses. See Validation method values.
- Columns shows or hides columns.
- Density changes the row spacing.
When you add more than one filter, choose And to show domains that match every filter, or Or to show domains that match any of them. For example, to see every domain that needs attention, add a Validation Status filter for Failed, another for Expired, and another for Pending, then choose Or. The search box always narrows the filtered results further.
To sort the table, click a column heading.
When no domains match your search and filters, or none of your CA accounts report domains, the tab shows No Domains Found.
View domains for one CA¶
- Sign in to Certificate Manager - SaaS.
- Click Integrations > Certificate Authorities.
- In the Connected CAs tab, click the name of the CA you want to view. That CA's details drawer opens.
- In the Administration tab, find the Authorized Domains section.
Each row represents a domain registered with your CA account.
| Column | Description |
|---|---|
| Domain | The domain name registered with the CA. |
| Validation Status | Where the domain is in the DCV process. See Validation status values. |
| Validation Method | The DCV method used to validate the domain. See Validation method values. |
| Validation Expires | The date when the current validation for this domain will expire. Shows N/A when the CA doesn't report an expiration date. |
Validation status values¶
Different CAs use different terms for the states of a domain's validation. Certificate Manager - SaaS normalizes each CA's native terms into a common set of statuses so you see the same vocabulary regardless of which CA you're viewing.
| Status | Description |
|---|---|
| Validated | The CA reports that the domain is validated. |
| Pending | The domain isn't validated yet. Depending on the CA, the domain might be waiting for you to complete a validation step, or for the CA to review it. |
| Expired | The domain was validated, but that validation has expired. The domain must be validated again. |
| Failed | The CA reports that the domain isn't validated, for example because a validation attempt failed or the CA lists the domain as inactive. Check the domain's validation in your CA. |
| Unknown | The CA reported a state that Certificate Manager - SaaS doesn't map to one of the other statuses, or didn't report enough information to determine one. To see the domain's state, sign in to your CA. |
Note
The status shown in Certificate Manager - SaaS may not match the exact term shown in your CA's own console. If a status seems inconsistent with what your CA reports, sign in to the CA to confirm the underlying state.
Validation method values¶
How the Validation Method column shows a method depends on the CA.
- Sectigo Certificate Manager, SSL.com, and SwissSign report one of the common methods in the following table. SwissSign always reports DNS_TXT.
- DigiCert, GlobalSign MSSL, GlobalSign Atlas, and HID PKIaaS report the method in the CA's own terms, exactly as the CA returns it. For example, DigiCert reports methods such as
dns-txt-tokenandhttp-token-static. For what a value means, see your CA's documentation.
| Method | Description |
|---|---|
| DNS_TXT | Validated by publishing a TXT record at the domain. |
| DNS_CNAME | Validated by publishing a CNAME record that points to a target provided by the CA. |
| HTTP | Validated by hosting a file at a well-known path on the domain's web server. |
| Validated by responding to an email sent to an address authorized for the domain. |
When the CA doesn't report a method, the Validation Method cell is blank in the Domains tab and shows N/A in the Authorized Domains table.
Status and method mappings by CA¶
Because each CA uses its own vocabulary, Certificate Manager - SaaS translates each CA's native terms into the normalized statuses described above, and for some CAs into the common methods. The following sections show, for each supported CA, how that CA's terms map to what you see in Certificate Manager - SaaS.
Sectigo Certificate Manager¶
The following Sectigo Certificate Manager states map to these Certificate Manager - SaaS validation statuses:
| Sectigo Certificate Manager state | Certificate Manager - SaaS status |
|---|---|
| validated | Validated |
| expired | Expired |
| not_validated | Pending |
| Any other state | Unknown |
The following Sectigo Certificate Manager methods map to these Certificate Manager - SaaS validation methods. When the domain's validation method is empty, which happens while validation is pending, Certificate Manager - SaaS uses the method from the domain's validation order instead.
| Sectigo Certificate Manager method | Certificate Manager - SaaS method |
|---|---|
| http_csr_hash, https_csr_hash, http, https | HTTP |
| dnstxt_random_value, dnstxt_persistent_value, txt, persistent_txt | DNS_TXT |
| cname_csr_hash, cname | DNS_CNAME |
| Any other method | Empty |
DigiCert¶
DigiCert validation status is determined by combining multiple fields. Certificate Manager - SaaS checks these conditions in order and uses the first one that applies:
| DigiCert condition | Certificate Manager - SaaS status |
|---|---|
| The CA reports the domain as inactive | Failed |
| Validation expiration time is in the past | Expired |
| The CA reports the domain as active and hasn't returned an approval date yet | Pending |
| The CA reports the domain as active and has returned an approval date | Validated |
| The CA doesn't report whether the domain is active | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from DigiCert.
GlobalSign MSSL¶
The following GlobalSign MSSL status codes map to these Certificate Manager - SaaS validation statuses:
| GlobalSign MSSL status code | Certificate Manager - SaaS status |
|---|---|
| 0, 1, 2, 8, 11 | Pending |
| 3, 7, 9, 10 | Validated |
| 5, 6 | Failed |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from GlobalSign MSSL.
GlobalSign Atlas¶
The following GlobalSign Atlas states map to these Certificate Manager - SaaS validation statuses:
| GlobalSign Atlas state | Certificate Manager - SaaS status |
|---|---|
| PENDING | Pending |
| VERIFIED | Validated |
Certificate Manager - SaaS returns the native validation method values as received from GlobalSign Atlas.
HID PKIaaS¶
The following HID PKIaaS states map to these Certificate Manager - SaaS validation statuses:
| HID PKIaaS state | Certificate Manager - SaaS status |
|---|---|
| VALIDATED | Validated |
| PENDING | Pending |
| EXPIRED | Expired |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from HID PKIaaS.
SSL.com¶
A domain that SSL.com reports as endorsed shows as Validated. For any other domain, the following SSL.com validation states map to these Certificate Manager - SaaS validation statuses:
| SSL.com validation state | Certificate Manager - SaaS status |
|---|---|
| active, validated | Validated |
| pending, in_progress | Pending |
| expired | Expired |
| failed, rejected, invalid | Failed |
| Any other state | Unknown |
The following SSL.com validation protocols map to these Certificate Manager - SaaS validation methods:
| SSL.com protocol | Certificate Manager - SaaS method |
|---|---|
| TXT | DNS_TXT |
| CNAME | DNS_CNAME |
| HTTP, HTTPS | HTTP |
| Any other protocol | Empty |
When the domain's validation doesn't report a protocol, Certificate Manager - SaaS uses the protocol of the domain's selected validation option instead.
SwissSign¶
The following SwissSign states map to these Certificate Manager - SaaS validation statuses:
| SwissSign state | Certificate Manager - SaaS status |
|---|---|
| VALID | Validated |
| PENDING | Pending |
| EXPIRED | Expired |
| NOT_VALIDATED | Failed |
| Any other state | Unknown |
When SwissSign doesn't report a state, Certificate Manager - SaaS shows Expired if SwissSign marks the domain as expired, Validated if it marks the domain as validated, and Failed otherwise.
Certificate Manager - SaaS reports the validation method for every SwissSign domain as DNS_TXT.
Supported CAs¶
The Domains tab and the Authorized Domains table show domains for these CAs:
Other CA Connector Framework CAs show an empty Authorized Domains table in their details drawer, and none of their domains appear in the Domains tab.