About Authorized Domains¶
Some certificate authorities show which domains you've registered with them, along with the current Domain Control Validation (DCV) status of each one. When a CA supports this, Certificate Manager - SaaS shows this information in an Authorized Domains table on the CA account's details page.
Because the CA's list of authorized domains determines which certificates you can request, this table helps you identify domains that need attention before a validation failure blocks certificate issuance.
Where to find the Authorized Domains table¶
- Sign in to Certificate Manager - SaaS.
- Click Integrations > Certificate Authorities.
- Click the name of the CA you want to view. That CA's details drawer opens.
- In the Administration tab, find the Authorized Domains section.
What the table shows¶
Each row represents a domain registered with your CA account.
| Column | Description |
|---|---|
| Domain | The domain name registered with the CA. |
| Validation Status | Where the domain is in the DCV process. See Validation status values. |
| Validation Method | The DCV method used to validate the domain. See Validation method values. |
| Validation Expires | The date when the current validation for this domain will expire. Shows N/A when the domain hasn't been validated. |
Validation status values¶
Different CAs use different terms for the states of a domain's validation. Certificate Manager - SaaS normalizes each CA's native terms into a common set of statuses so you see the same vocabulary regardless of which CA you're viewing.
| Status | Description |
|---|---|
| Validated | The domain has been successfully validated by the CA and is ready for certificate issuance. Certificates can be requested for this domain without additional validation steps. |
| Pending | Domain validation is currently in progress. The CA is actively attempting to verify domain control through the configured validation method. |
| Expired | The domain was previously validated, but that validation has expired and must be renewed. The validation period has exceeded the CA's time limits, and the domain cannot be used for certificate issuance until it is validated again. |
| Failed | The CA's validation attempt was unsuccessful. The domain cannot be validated as configured. Review the validation method and ensure the required DNS records, files, or email responses are properly configured. |
| Unknown | Certificate Manager - SaaS could not determine the validation status from the CA, typically due to an API error or unexpected response. This is a fallback status used when the CA's response cannot be interpreted. |
Note
The status shown in Certificate Manager - SaaS may not match the exact term shown in your CA's own console. If a status seems inconsistent with what your CA reports, sign in to the CA to confirm the underlying state.
Validation method values¶
| Method | Description |
|---|---|
| DNS_TXT | Validated by publishing a TXT record at the domain. |
| DNS_CNAME | Validated by publishing a CNAME record that points to a target provided by the CA. |
| HTTP | Validated by hosting a file at a well-known path on the domain's web server. |
| Validated by responding to an email sent to a well-known address at the domain. |
The Validation Method column may be empty (N/A) for a domain that hasn't been validated yet, or when the CA doesn't report a method for the current state.
Status and method mappings by CA¶
Because each CA uses its own vocabulary, Certificate Manager - SaaS translates each CA's native terms into the normalized statuses and methods described above. The following tables show, for each supported CA, how that CA's terms map to what you see in Certificate Manager - SaaS.
Sectigo Certificate Manager¶
The following Sectigo Certificate Manager states map to these Certificate Manager - SaaS validation statuses:
| Sectigo Certificate Manager state | Certificate Manager - SaaS status |
|---|---|
| validated | Validated |
| expired | Expired |
| not_validated | Pending |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from Sectigo Certificate Manager.
DigiCert¶
DigiCert validation status is determined by combining multiple fields:
| DigiCert condition | Certificate Manager - SaaS status |
|---|---|
| Domain is not returned as active from the CA | Failed |
| Validation expiration time is in the past | Expired |
| Domain is returned as active and there's no approval date returned from the CA yet | Pending |
| Domain is returned as active and there's an approval date returned from the CA | Validated |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from DigiCert.
GlobalSign MSSL¶
The following GlobalSign MSSL status codes map to these Certificate Manager - SaaS validation statuses:
| GlobalSign MSSL status code | Certificate Manager - SaaS status |
|---|---|
| 0, 1, 2, 8, 11 | Pending |
| 3, 7, 9, 10 | Validated |
| 5, 6 | Failed |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from GlobalSign MSSL.
GlobalSign Atlas¶
The following GlobalSign Atlas states map to these Certificate Manager - SaaS validation statuses:
| GlobalSign Atlas state | Certificate Manager - SaaS status |
|---|---|
| PENDING | Pending |
| VERIFIED | Validated |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from GlobalSign Atlas.
HID PKIaaS¶
The following HID PKIaaS states map to these Certificate Manager - SaaS validation statuses:
| HID PKIaaS state | Certificate Manager - SaaS status |
|---|---|
| VALIDATED | Validated |
| PENDING | Pending |
| EXPIRED | Expired |
| Any other state | Unknown |
Certificate Manager - SaaS returns the native validation method values as received from HID PKIaaS.
Supported CAs¶
The Authorized Domains table appears on the details page for these CAs:
Support for additional CAs is being added over time.