Purchasing an Official SSL Certificate

CCM allows you to purchase and request various globally trusted SSL certificates from multiple CAs. You can apply for a certificate once your purchase is complete. For details, see Figure 1. This section describes how to purchase an SSL certificate, including scenario-based certificate selection, certificate purchase procedure, and FAQ, to help you select and purchase SSL certificates.

Figure 1 Certificate purchase and application process
Click to enlarge

Selection by Scenario

Scenario 1: personal or non-commercial websites

Typical scenarios: non-commercial or non-production scenarios such as personal blogs, presentations, local development and testing, and teaching demonstration.
Service characteristics:
- No data transmission involved
- Used for display purposes
Recommended certificates:
- Test certificates: suitable for individual or enterprise test websites. Each cloud account can apply for 20 test certificates for free. The validity period of a single certificate is three months. For details about the differences between test certificates and official certificates, see Table 1. For details about how to create a test certificate, see Creating a Test Certificate. If the test certificate is used up, you can purchase a test certificate capacity expansion package. For details, see Purchasing a Test Certificate Capacity Expansion Package.
- DV certificates: suitable for individual or enterprise test websites. Domain ownership is easily verified, and the certificate can be issued within several hours. For details about the differences between certificates, see Certificate Types.

Scenario 2: online business production environments (such as official websites, e-commerce, and applets) of small- and medium-sized enterprises

Typical scenarios: public-facing business systems, including enterprise official websites, backend services of applets, e-commerce platforms of small- and medium-sized enterprises, and SaaS application portals.
Service characteristics:
- Having strict requirements for data confidentiality
- No requirement for identity display in the website address bar
- Having requirements for adding multiple sites later
Recommended certificates: OV certificates OV certificates use stronger encryption algorithms, which are suitable for the websites, applications, and applets of small- and medium-sized enterprises. In addition, OV certificates have relatively high authentication strength and need to verify the authenticity and domain ownerships of organizations and enterprises. If multiple subdomains need to be protected, wildcard OV certificates are preferred. For details about the differences between certificates, see Certificate Types.

Scenario 3: highly trusted production environments for industries such as finance, banking, and insurance

Typical scenarios: Mission-critical business systems (such as government platforms, e-banking systems, payment gateways, stock exchange systems, and large-sized enterprise portals)
Service characteristics:
- Having strict requirements for data confidentiality
- Required to display identity information in the website address bar
Recommended certificates: EV certificates. EV certificates use stronger encryption algorithms, which are suitable for the websites, applications, and applets of large-sized enterprises or organizations, such as government departments, e-commerce platforms, online education agencies, financial institutions, and healthcare agencies. EV certificates have the highest security level and strictly verify the authenticity and domain ownership of organizations and enterprises. For details about the differences between certificates, see Certificate Types.

Prerequisites

The IAM user who purchased the certificate has been granted the SCM Administrator/SCM FullAccess, BSS Administrator, and DNS Administrator permissions.

BSS Administrator: has all permissions on account center, billing center, and resource center. It is a project-level role, which must be assigned in the same project.
DNS Administrator: has full permissions for DNS.

For details, see Permissions Management.

Constraints

Special enterprises cannot apply for OV or EV certificates. For example, military units, some government agencies, and national security departments.

Organizations which want to apply for OV and EV certificates must verify their identity through the unified social credit code published on the national official website. Special enterprises cannot verify their organization identity because there are no related details on that website.

Purchasing SSL Certificates

Log in to the CCM console.
In the navigation pane on the left, choose SSL Certificate Manager > SSL Certificates. In the upper right corner of the page, click Buy Certificate.

On the certificate purchase page, specify parameters. For details, see Certificate selection.

Figure 2 Certificate selection

Click to enlarge

Domain Type: Select a domain name type.

Only Single domain, Multiple domains, or Wildcard can be selected for your certificates. For details about the parameters, see Table 1.

**Table 1** Domain types
Domain Type	Description
Single domain	An SSL certificate can secure only one domain name. For example, example.com.
Multiple domains	Multiple domain names can be associated with an SSL certificate. You can associate a multi-domain certificate with up to 250 domain names. A wildcard domain name is allowed only by OV or OV pro multi-domain certificates. Other types of multi-domain certificates can only be associated with multiple single domain names You can associate a multi-domain certificate with multiple domain names at different time points. For example, if you purchase a multi-domain certificate with three domain names, you can associate it with two domain names when applying for the certificate, and associate it with the last domain name after the certificate is issued. The number of domain names a multi-domain certificate can protect depends on the domain quantity you configure when you buy the certificate. If you have more domain names to protect after the purchase completes, purchase another certificate for them.
Wildcard domain	Only one wildcard domain can be associated with an SSL certificate. Domain names having multiple wildcard characters, such as ..example.com, are not supported. Only one wildcard character is allowed in a wildcard domain name, for example, *.example.com, which may include domain names a.example.com, b.example.com, and more, but does not include a.a.example.com.
For details about how to select a domain type, see How Do I Select an SSL Certificate? After a single-domain or wildcard-domain certificate is associated with a domain name, the domain name is automatically protected. For details about the domain name granting rules, see the secure objects of different certificates.

Set the domain quantity.
- If the Domain Type value is Single domain or Wildcard, you can only associate one domain name with a certificate.
- If the Domain Type value is Multiple domains, you can associate 2 to 250 domain names with a certificate. Set the quantity of domain names based on your needs.

Select a certificate type.

For more details, see Table 2.

**Table 2** Certificate types
Certificate Type	Application Scenario	Verification Requirements	Security	Approval Period
EV Pro	EV certificates use stronger encryption algorithms, which are suitable for the websites, applications, and applets of large-sized enterprises or organizations, such as government departments, e-commerce platforms, online education agencies, financial institutions, and healthcare agencies.	CAs will verify the organization's identity and domain name ownership.	Highest	7 to 10 working days
EV	Websites, applications, and applets of large enterprises or organizations, such as government departments, e-commerce platforms, online education agencies, financial institutions, and healthcare agencies	CAs will verify the organization's identity and domain name ownership.	Highest	7 to 10 working days
OV Pro	OV Pro certificates use stronger encryption algorithms than OV certificates, which are suitable for websites, applications, and applets of small- and medium-sized enterprises.	CAs will verify the organization's identity and domain name ownership.	High	3 to 5 working days
OV	Websites, applications, and applets of small- and medium-sized enterprises	CAs will verify the organization's identity and domain name ownership.	High	3 to 5 working days
DV (Basic)	Personal websites and enterprise tests.	The CA verifies the domain name ownership only.	General	Several hours
For more details, see Differences Between SSL Certificate Types.

Select a certificate authority.
DigiCert and GeoTrust are available CAs in CCM. For more details, see Differences Between Certificate Types.

DigiCert and GeoTrust certificates will be issued using the DigiCert Global Root G2 root certificates since December 1, 2024. For details about certificate chain changes, see [October 28, 2024] Notice on Switching the DigiCert Root Certificate.

Select Subscription Period. The default value is 1 year.

Changes in the maximum validity period of SSL certificates:

From March 15, 2026, the maximum validity period of all SSL certificates is shortened to 200 days. After March 15, 2029, the maximum validity period is further shortened to 47 days. For details about the maximum validity period of SSL certificates corresponding to specific time points, see Table 3.

**Table 3** Maximum validity period of SSL certificates
Time Point	Maximum Validity Period of SSL Certificates
Before March 15, 2026	398 days
March 15, 2026 to March 2027	200 days
March 2027 to March 2029	100 days
After March 2029	47 days

Subscription period:

Huawei Cloud CCM provides subscription services. Certificate subscription instances are automatically generated after purchase. You can purchase one, two, or three-year certificate services in a single order. That is, CCM will issue multiple certificates with consecutive validity periods within the subscription period. Table 4 describes the subscription periods of different types of certificates.

**Table 4** Subscription period
Subscription Period	Description	Validity Period of a Single Certificate	Precautions After Certificate Issuance
One year	Multiple certificates are included. For example, if the maximum validity period of a certificate is 200 days: The system issues a certificate with a validity period of 199 days, and automatically applies for a second certificate based on the information about the first certificate 30 days before the certificate expires. The second certificate will supplement the remaining days in the one-year validity period and maintain continuity with the validity period of the first certificate. For example, if the second certificate is issued 30 days in advance, the overall validity period is 199 days + 166 days + 30 days. You need to complete domain name or organization verification in a timely manner to ensure that the second certificate can be issued in a timely manner. NOTICE: If the certificate is issued by GlobalSign, the system will directly issue two certificates with a validity period of 199 days.	The following uses the maximum validity period of 200 days as an example: The validity period of a single certificate is 199 days. (To avoid the impact of factors such as leap seconds, the validity period of a single certificate issued before March 2027 is set to 199 days.) Each certificate's validity starts upon issuance. Within the subscription, the system automatically generates the next certificate and submits an application 30 days prior to expiration (15 days for DigiCert DV (basic) wildcard certificates).	You need to manually install the renewed certificate on your web server or on Huawei Cloud products to replace the previous one. For details, see Installing an SSL Certificate. If you do not install or deploy the renewed certificate, your server or Huawei Cloud products cannot enable HTTPS-encrypted communications after the first certificate expires.
2–3 years	The system will deliver the one-year subscription service to you in two or three times. Each subscription service delivers multiple certificates. You need to complete domain name or organization verification in a timely manner to ensure that the subsequent certificates can be issued in a timely manner.

If you have not enabled auto-renewal, manually renew the subscription or purchase another one 3 to 10 working days before it expires. If you have enabled auto-renewal, check the validation emails from the CA and finish required verification 3 to 10 working days before it expires to ensure that the certificate is valid before the CA validates your verification and issues a new certificate.

To ensure automatic application of certificates, do not cancel privacy authorization.
A new CSR is automatically used to apply for a new certificate within the subscription period. If you use a CSR generated by yourself to apply for a certificate, the system reuses the original CSR by default. However, for vTrus certificates, a new CSR must be used. Otherwise, the certificate application fails.
Newly purchased services are displayed as instances in the Subscription View. Note that original certificates have been automatically converted and will no longer appear here.

Set the number of certificates you want to buy in the Quantity field.
(Optional) Tags: Add a tag to the purchased certificate. For details, see Creating a Tag.

Confirm the certificate chain change.

If you want to purchase a GeoTrust or DigiCert certificate, a dialog box is displayed. Read the information carefully and click OK.
Confirm the order information and agree to the CCM statement by selecting I have read and agree to the Cloud Certificate & Manager Statement. Click Pay.
On the displayed page, select a payment method.

After the payment is successful, you can go to the SSL Certificate Manager > SSL Certificates page to view certificates you purchased.
- To view your paid certificates, click the SSL Certificates tab.
- To view your test certificates, click the Test Certificates tab.

Follow-up Procedure

After you purchase an SSL certificate, you still need to associate a domain name with it, provide certain details, and then submit it to the corresponding CA for approval. The CA issues the certificate only after all information is approved. For details, see Submitting an SSL Certificate Application.