Domain validation is the certificate authority’s check that the requester controls the domain named in a certificate signing request (CSR). Without it, anyone could submit a CSR for a domain and obtain a certificate. section 9.1.3
A certificate authority can verify control in three common ways:
- Email: sends a verification message to a registered domain contact; the administrator follows its link. This is familiar but difficult to automate. section 9.1.3
- HTTP-01: provides a challenge file that the requester places at a specific location on the domain’s web server; the authority checks for it. section 9.1.3
- DNS-01: requires the requester to add a specific DNS TXT record, which the authority checks after the change becomes visible. section 9.1.3
A CSR for example.com
A requester submits a CSR for example.com. The certificate authority must first establish that the requester controls example.com, using an email, HTTP-01, or DNS-01 challenge. Only after successful validation does it issue the certificate. section 9.1.3
Figure 9.5 Domain validation via email. This figure shows how a CA verifies that the CSR requester controls the domain. After receiving the CSR, the CA sends a validation email. The requester must click a link to prove access to the domain’s registered inbox. After verification, the CA issues the certificate.
Follow the email challenge from CSR submission through inbox verification and certificate issuance. section 9.1.3
Figure 9.6 Domain validation via HTTP challenge. This flow illustrates how a CA validates domain ownership using an HTTP challenge. The requester sends a CSR, receives a challenge file from the CA, and places it at a specific location on their website. When the CA finds the file at that location, it confirms domain control and issues the certificate.
Follow the HTTP challenge file from CSR submission to web-server placement and authority verification. section 9.1.3
Figure 9.7 Domain validation via DNS challenge. This figure shows how a CA verifies domain ownership by requiring specific DNS changes. The requester receives a challenge from the CA and updates the DNS records accordingly. When the changes are live, the CA checks the DNS to confirm control and issues the certificate.
Follow the DNS challenge from receiving the request through publishing the required DNS record and verification. section 9.1.3
