Upload the Random Value as a Publicly Viewable Dns Txt Record and Inform Us When It Is Visible
Editor'south Note: This weblog was originally posted in September of 2016. It has been reviewed for clarity and accuracy past GlobalSign Product Manager Sebastian Schulz and updated accordingly.
Sometimes, even PKI veterans struggle with ordering or installing SSL/TLS certificates. This does not propose a lack of knowledge – rather, those processes can bring upwards previously unseen errors. Ordering the correct certificate, creating a CSR, downloading it, installing it, and testing it to make sure there are no problems are all areas where i may encounter errors.
Nosotros want to help make the process every bit simple as possible from offset to end. For that reason, we collated our top queries and bug that customers may confront during ordering or installation. We hope this blog will aid you avoid those pitfalls and streamline your time to completion, only if you have a problem that yous cannot solve using this blog you lot tin can still cheque out the GlobalSign Support Knowledge Base or submit a ticket.
Choosing the Correct Approval Method
In that location are three means to have your domain verified with us: approver e-mail, HTTP verification, and DNS TXT tape. And if at some signal you abound tired of verifying domains every time you society a certificate, why non give Managed SSL a try?
Note: When ordering an SSL Certificate from our system, approval methods cannot be inverse once chosen.
Approver Electronic mail
When placing an order, you can choose from the post-obit email addresses to let u.s. to verify your domain:
- admin@domain.com
- administrator@domain.com
- hostmaster@domain.com
- postmaster@domain.com
- webmaster@domain.com
An e-mail will exist sent to the selected address and upon receipt of the email you tin can click a link to verify the domain is yours.
Note: Make sure yous choose the right one, or yous will take to cancel the order and start a new society.
If y'all do non have access or cannot fix an email from the above list, you lot will need to contact Back up who will guide you through other possible options for electronic mail verification. These are:
- Updating the WHOIS records with an email address (an example of a website GlobalSign uses to check Who is records is networksolutions.com).
- Creating a page on the website of the domain using instructions from our support team. This will indicate command of the domain and allow the vetting team to send the approval email to ANY alternative email address.
NOTE: A dedicated support commodity guiding you through domain verification by approver email tin be found here.
HTTP Verification
Using the HTTP Verification (also called Approver URL- or meta tag-) method, you can insert a random string provided by GlobalSign in the root folio of your domain (for example domain.com). The directory chosen for this must be domain.com/well-known/pki-validation/gsdv.txt
Our verification system will be able to detect the meta tag on the page and verify the domain ownership. However, our system cannot verify the domain if it redirects to some other page so make certain to disable all redirects.
Note: A dedicated support article guiding yous through domain verification by HTTP verification can be found hither.
DNS TXT Tape
DNS TXT records entail implementing a code into the DNS TXT of the registered domain. You need to brand sure the cord exactly matches what you were provided at the cease of ordering your certificate or from our vetting team. Too, y'all need to make sure that the record is publicly accessible. You can use some free online tools to bank check your DNS TXT records. Alternatively, y'all can run a command in command prompt to see if at that place is a txt entry, for example: nslookup -type=txt domain.com
Note: A dedicated support article guiding you through domain verification by DNS TXT tape tin can be found here.
Private Cardinal Missing
Ordering an SSL/TLS certificate requires the submission of a CSR and in order to create a CSR a private key has to be created. Your private key matching your certificate is usually located in the same directory the CSR was created. If the private cardinal is no longer stored on your machine (lost) then the certificate will need to be reissued with a new CSR and therefore also a newly created private key.
Examples of fault letters/situations which would indicate there is no individual key:
- 'Private primal missing' error message appears during installation
- 'Bad tag value' fault message appears during installation
- After importing the certificate into IIS, the certificate disappears from the list when refreshed
- When going onto your website, the site does not load in https://
No affair how convenient it seems, nosotros want to discourage the apply of online tools to generate CSRs. Those will as well accept your private key, meaning the security of your server may exist compromised in the future.
Notation: Nosotros offer many guides to help you generate private keys and CSRs.
SAN Compatibility
With a discipline culling name or SAN certificate, there are several things to notation before ordering:
- UCC (Unified Communication) SANs can be selected for free. Those cover some direct subdomains of the Common Name (for example, domain.com):
- post.domain.com
- owa.domain.com
- autodiscover.domain.com
- www.domain.com
- Subdomain SANs are applicable to all host names extending the Common Name past ane level. For example:
- support.domain.com could be a Subdomain SAN for a document with the Mutual Name domain.com
- advanced.back up.domain.com could NOT be covered by a Subdomain SAN in a document issued to domain.com, as it is not a straight subdomain of domain.com
- FQDN (Fully Qualified Domain Name) SANs are applicable to all fully qualified host names, unrelated to the Common Name
- support-domain.internet could exist a FQDN SAN in a document with the Common Proper name domain.com
- support.domain.com would too be a valid FQDN for a certificate with Mutual Proper name domain.com, but roofing this pick with a Subdomain SAN is the smarter choice
- IP Addresses can not be covered by FQDN SANs
- SANs for Public IP Addresses will merely piece of work for registered and public Global IP Addresses, otherwise ownership cannot be verified
- Wildcard SANs piece of work the same way as FQDN SANs but will cover an entire subdomain level, no matter what stands for the asterisk
- For example, the Wildcard SAN *.domain.com will cover support.domain.com, gcc.domain.com, post.domain.com – and and then on!
For the compatibility of the different SAN Types with different products, delight see the tabular array below:
Information technology is too possible to remove a SAN subsequently your certificate has been issued.
Invalid CSR
If you are creating a renewal CSR, so y'all will need to ensure the Mutual Proper name matches the one of your original CSR. The new CSR will not be the same since the private central must be unlike. You may not apply the same CSR again, even if it seems convenient.
Y'all can test a CSR by using the decoder in the Managed SSL Tab of your GlobalSign accounts. Should you not have that available, you lot can safely use online resources to cheque your CSR, as long as y'all do non share your private key you lot do non have to be concerned for their security. If there are whatever extra spaces or also many or also few dashes at the starting time/end of the certificate request, it will invalidate the CSR.
-----Begin CERTIFICATE Asking-----
-----END CERTIFICATE Request-----
The Common Name You Take Entered Does Non Match the Base of operations Option
This error appears when you are ordering a Wildcard SSL Certificate but have non included the asterisk in the Common Proper name of the CSR (eastward.g. a CSR with CN domain.com, rather than*.domain.com). Or if conversely, you accept entered *.domain.com with the CSR and not selected that you wish to society a Wildcard document.
As earlier explained, the [*] represents all sub-domains y'all can secure with this type of document. For example, if you want to secure www.domain.com, mail.domain.com and secure.domain.com, you lot will demand to enter *.domain.com as the Common Name in the CSR.
Notation: Y'all cannot create a Wildcard with a sub-domain before the asterisk, e.g. mail.*.domain.com, or double Wildcards, such as *.*.domain.com.
Key Indistinguishable Fault
This error appears when you are using a private fundamental which has already been used. A private key and CSR must but be used ONCE.
You should generate a new private key and CSR on your server and re-submit the new CSR. The reason SSL/TLS certificates have a maximum validity (and this one being cut brusk repeatedly) is an try to ensure that keys are exchanged frequently, therefore mitigating the risk of undetected compromise.
Gild State Has Already Been Changed
This error bulletin mostly appears when your order has timed out. You should start the ordering process from scratch and to let u.s. know if the consequence persists. If it does, nosotros need to run farther checks on your account.
NOTE: this error message tin can also be caused past wrongly specified SANs. For instance, if the CN is "www.domain.com" and you specified sub-domain equally "domain.domain2.com" which specifies a carve up FQDN. Cheque the information about SANs above for clarification.
The SANs Options You Accept Entered Do Not Match the SAN Options on the Original Certificate
This problem tin can occur for several reasons:
- You added a infinite earlier or after the SAN.
- There is a typo in the information you take provided.
- You are entering the Common Name (CN) of the document as a SAN. Following regulations, we volition always add your Common Name as a SAN, this does not need to be specified.
- You incorrectly enter the SAN as a sub-domain, multi-domain name, internal SAN or IP. You demand to cull the right blazon of SAN which applies to the SAN. Delight also check the above information on different SANs.
Document Non Trusted in Web Browser
After installing the certificate, you may still receive untrusted errors in certain browsers. This happens when the intermediate document has not been installed or for some reason the GlobalSign Root Document is missing from the client connecting to your server. Unless the client has been heavily tampered with, this should not occur – our Root Certificates are embedded in virtually all modern operating systems and applications.
Running a wellness check on the domain will identify missing intermediate certificates. If the intermediate document is missing, apply the following link to determine which intermediate is needed based on product type (DomainSSL, OrganisationSSL, ExtendedSSL, AlphaSSL etc).
Findout more than about intermediate certificates and why we employ them.
'Switch From Competitor' Mistake Bulletin
When choosing the 'switch from competitor' selection in our document ordering system, you may see the following fault message:
The server hosting your existing certificate cannot be reached to confirm its validity. Please obtain a re-create of your existing certificate and paste it in the box below. All competitive switches are subject to review by GlobalSign's vetting team against the trusted issuers in the browser trust stores. If your certificate is non issued past a valid root CA Certificate, information technology will be bailiwick to cancellation and/or revocation.
This error message occurs when your current certificate is no longer valid. Yous should merely cull this choice if you are switching before your certificate with another visitor expires.
This mistake bulletin could too occur if your current certificate is not installed on the domain. Our organization will non exist able to detect the validity in this case so y'all should untick this selection and become through the normal ordering process.
If you have a valid certificate from a competitor that is not installed on the server then yous can paste your CSR into the text box using the 'Switch from Competitor' option. See the below image.
Finally, this error message could bear witness when you lot take installed a certificate on your server but the CN is not the aforementioned as the domain proper name. For example, this can happen with a SAN certificate. In this case, simply untick 'switch from a competitor' and become through the normal ordering process.
If you are switching over to GlobalSign that'south great! If you call up you should be eligible for 30 days of free validity merely if yous cannot go through with the process simply contact u.s. and a squad member will reach out to yous.
For more aid with general SSL Certificate queries then visit the Full general SSL folio on our support site.
Source: https://www.globalsign.com/en/blog/top-ssl-certificate-errors-and-solutions
0 Response to "Upload the Random Value as a Publicly Viewable Dns Txt Record and Inform Us When It Is Visible"
Post a Comment