Paid SSL certificates

Wondering how paid SSL certificates are issued, validated, and renewed at Cyberfusion?

This article explains the paid SSL certificate lifecycle.

Which validation applies to you

• The domain is registered with Cyberfusion and uses Cyberfusion's nameservers → DNS validation. Automatic, nothing for you to do.
• Anything else → Email validation. You have to click a link in an email sent to the approver address.

Validation

Before a certificate is issued, ownership of the domain must be validated. This is called Domain Control Validation (DCV).

DNS

Fully automatic. No action required from you.

Possible only when both are true:

• The domain is registered with Cyberfusion.
• The domain uses Cyberfusion's nameservers.

If either is not true, email validation is used instead.

Email

The Certificate Authority (CA) sends a validation email to the configured approver email address. Click the link in that email to validate the certificate.

Approver email

The list of usable addresses is limited and set by the CA. They are typically prefixed with admin@, administrator@, and similar.

To view or change it:

1. On the platform, navigate to the certificate.
2. Click 'Change approver email'.

You then see the list of approver emails the CA accepts for that domain.

Renewal

A renewal request is sent 14 days before the expiration date. Certificates are currently renewed every 6 months.

Lifetimes are getting shorter

The CA/Browser Forum is progressively shortening the maximum certificate lifetime:

As the maximum drops, certificates are renewed more often — eventually every few days.

Extended Validation

Extended Validation (EV) certificates require additional steps, including phone validation.

EV is not commonly used. Most projects use Domain Validation (DV) certificates, described above.