Resolving a DNS Record on Huawei Cloud or Alibaba Cloud

After you submit an SSL certificate application to the CA, you need to verify domain name ownership as required by the CA. This topic describes how to verify your domain name ownership by DNS.

Background

After you apply for an SSL certificate from a CA, you are required to verify the domain name ownership. You need to work with the CA to complete the domain name ownership verification. After your ownership of the domain name is verified by you and approved by the CA, the status of your certificate will change.

If you do not complete the domain ownership verification, your certificate will remain in the Pending domain name verification state.

Domain name ownership verification by DNS is to verify domain ownership by resolving a specific DNS record on the platform hosting the domain name. When you apply for a certificate and select DNS for Domain Name Verification Method, follow the instructions in this part to complete the verification.

Procedure

Obtain the host record and record value of a certificate. For details, see Obtaining the Host Record and Record Value of a Certificate.
Perform domain name ownership verification by DNS.
Domain name ownership verification by DNS is to resolve DNS records, which can be performed only on the domain name management platform that hosts your domain name. The following examples are for your reference.
- If your domain name is hosted in the DNS service on Huawei Cloud, complete the resolution by following the instructions in Huawei Cloud DNS TXT Resolution.
- If your domain name is hosted in the DNS service on Alibaba Cloud, complete the resolution by following the instructions in Alibaba Cloud DNS TXT Resolution.
Check whether the ownership verification takes effect. For details, see Verifying DNS Configurations.

Obtaining the Host Record and Record Value of a Certificate

Log in to the management console.
Click in the upper left corner of the page and choose Security & Compliance > Cloud Certificate Management Service. The service console is displayed.
In the navigation pane on the left, choose SSL Certificate Manager. In the row containing the desired certificate, click Verify Domain Name in the Operation column. The Verify Domain Name page is displayed.
On the Verify Domain Name page, view the content for Host Record, Record Type, and Record Value. Figure 1 shows an example.

If Host Record, Record Type, and Record Value are not displayed, log in to the mailbox to view. The mailbox is the one you provide during certificate application.
Figure 1 Viewing a host record

Huawei Cloud DNS TXT Resolution

Refer to this part if you are managing your domain name on Huawei Cloud.

Log in to the management console.
Choose Domain Name Service under Network to go to the Domain Name Service page.
In the navigation pane on the left, choose DNS Resolution > Public Zones.
In the domain name list on the Public Zones page, click the added domain name (or the primary domain name for a multi-domain certificate) to go to the record set page.

In the upper right corner of the page, click Add Record Set. Figure 2 shows an example.

If there is a DNS record of domain name domain3.com in the domain name list, click Modify in the Operation column. Modify the record in the displayed Modify Record Set dialog box.

Figure 2 Adding a record set

**Table 1** Parameters for adding a record set
Parameter	Description
Name	Host record returned by the domain name service provider on the domain name verification page of the certificate.
Type	Record type returned by the domain name service provider on the domain name verification page.
Alias	Select No.
Line	Select Default.
TTL (s)	Set this parameter to 5 min. A larger TTL value indicates less frequency of DNS record synchronization and update.
Value	Record value returned by the domain name service provider on the domain name verification page of the certificate. NOTE: Record values must be quoted with quotation marks and then pasted in the text box.
Keep other settings unchanged.

Click OK.
If the status of the record set is Normal, the record set is added successfully.
- DNS configuration records can be deleted only after the certificate is issued or revoked.
- Check whether the DNS record is correctly configured. If not, the certificate cannot be issued.
After the verification is complete, additional time is required for the CA to verify your domain name. During this period, the certificate is in the Pending domain name verification state.

The certificate enters the Pending organization verification state only after the CA has confirmed your domain ownership.

Alibaba Cloud DNS TXT Resolution

If your domain name is hosted in Alibaba Cloud, you need to add a record through the Alibaba Cloud DNS console to complete the verification.

Log in to the Alibaba Cloud DNS console.
On the Manage DNS page, click the Domains tab and click the name of the domain name for which you want to configure a record.
Click Add Record and provide the following information:
- Record Type: Enter the record type obtained in Obtaining the Host Record and Record Value of a Certificate.
- Host: Enter the prefix of the host record obtained in Obtaining the Host Record and Record Value of a Certificate.
- ISP line: Select Default. You must specify an ISP line. Otherwise, your domain name may become inaccessible to some users.
- Value: TXT record from the SCM console. To obtain the record, refer to Obtaining the Host Record and Record Value of a Certificate.
- TTL: cache time. The smaller the value, the faster the modification takes effect. The default value is 600 seconds.
Click OK.

Verifying DNS Configurations

Select a command based on the record type and OS and check whether the DNS configuration takes effect.

Use TXT record _dnsauth.domain.com as an example.

For TXT records

For Windows OSs:
```
nslookup -q=TXT _dnsauth.domain.com
```
For Linux OSs:
```
dig TXT _dnsauth.domain.com
```
For macOS OSs:
```
dig TXT _dnsauth.domain.com
```

For CNAME records

Windows OSs
```
nslookup -q=CNAME _dnsauth.domain.com
```
Linux OSs
```
dig CNAME _dnsauth.domain.com
```
macOS OSs
```
dig CNAME _dnsauth.domain.com
```

If the value recorded in the command output (value of text) is the same as that returned by the domain name service provider, the configuration of domain name ownership verification has taken effect.

Parent topic: Best Practices for SSL Certificate Manager

Previous topic: Best Practices for SSL Certificate Manager

Next topic: Enabling HTTPS Encryption for Websites