Overview
SSL/TLS certificates secure website traffic by encrypting communication between a visitor’s browser and the server. Before a Certificate Authority, or CA, issues an SSL certificate, it must verify that the requester is allowed to use the domain or organization name.
The most common verification process is DCV, which stands for Domain Control Validation. DCV confirms that you control the domain name for which the SSL certificate is being issued. cPanel AutoSSL uses domain-validated certificates and automatically attempts to validate eligible domains before installing certificates.
What Is DCV?
DCV, or Domain Control Validation, is the process used to prove ownership or control of a domain name.
For example, if you request an SSL certificate for:
example.com
the Certificate Authority must confirm that you control example.com before it can issue the certificate.
DCV is used for SSL certificate orders across DV, OV, and EV certificates, because every certificate must verify domain control before issuance.
Common DCV Methods
1. HTTP File Validation
With HTTP validation, the Certificate Authority asks you to place a specific verification file or token on your website.
The CA then checks a URL similar to:
http://example.com/.well-known/pki-validation/example-file.txt
If the file is accessible and contains the expected value, the domain is verified.
This method is commonly used when the domain already points to the correct hosting server. It can fail if the domain points elsewhere, the website is behind a proxy, redirects are misconfigured, or access to the .well-known directory is blocked.
2. DNS Validation
With DNS validation, you prove control of the domain by adding a specific DNS record, usually a TXT record, to the domain’s DNS zone.
Example:
| Record Type | Name | Value |
|---|---|---|
| TXT | _acme-challenge.example.com | Verification token provided by CA |
After the DNS record propagates, the CA checks the record and validates the domain.
DNS validation is useful when the website is not yet live, does not point to the hosting server, uses external DNS, or requires a wildcard SSL certificate. Let’s Encrypt notes that DNS-01 validation is the challenge type used for wildcard certificates.
3. Email Validation
With email validation, the Certificate Authority sends a verification email to an approved domain-related email address.
Common approval addresses may include:
[email protected][email protected][email protected][email protected][email protected]
The user clicks the approval link in the email to confirm domain control.
This method is simple but depends on the domain’s email service working correctly.
4. TLS / ALPN Validation
TLS-ALPN validation confirms domain control through a TLS response on port 443. This method is commonly used by automated certificate systems and requires the server to respond correctly during the SSL/TLS handshake. Let’s Encrypt lists TLS-ALPN-01 as one of its supported challenge types.
This method is less commonly managed manually by shared hosting users but may be used by automated systems.
SSL Certificate Validation Levels
DCV is a verification method, but SSL certificates also have different validation levels.
Domain Validation, or DV
A DV SSL certificate only verifies control of the domain name.
This is the most common SSL type for shared hosting, blogs, small websites, landing pages, and basic business websites. AutoSSL certificates in cPanel are domain-validated certificates.
DV certificates provide encryption, but they do not verify the legal identity of a company or organization.
Organization Validation, or OV
An OV SSL certificate verifies both:
- Domain control
- Organization identity
The Certificate Authority checks business details such as the organization name, registration information, and sometimes business location or phone records.
OV certificates are commonly used by businesses that want visitors to know the website is connected to a verified organization.
Extended Validation, or EV
An EV SSL certificate requires the highest level of business validation.
The Certificate Authority performs stricter checks on the legal entity, business registration, operational status, and authorization of the person requesting the certificate. DigiCert describes EV certificates as high-assurance identity certificates because they verify the domain owner, organization, and legal entity.
EV certificates are often used by banks, financial services, large eCommerce platforms, and organizations that require stronger identity assurance.
Other SSL Certificate Types
Single-Domain SSL
Secures one domain only.
Example:
example.com
Depending on the certificate, it may or may not also cover:
www.example.com
Wildcard SSL
Secures a domain and its subdomains.
Example:
*.example.com
This can cover:
mail.example.comshop.example.comblog.example.com
Wildcard SSL certificates usually require DNS validation.
Multi-Domain SSL / SAN SSL
A Multi-Domain certificate, also called a SAN certificate, secures multiple domain names under one certificate.
Example:
example.comexample.netexample.org
This is useful when one account or business manages several related domains.
cPanel and AutoSSL Verification
In cPanel, AutoSSL automatically checks eligible domains and attempts to issue and install SSL certificates. AutoSSL can secure services such as Apache, Dovecot, Exim, Web Disk, and cPanel server services.
For AutoSSL to work correctly, the domain usually needs to:
- Point to the correct hosting server.
- Resolve properly in DNS.
- Be publicly accessible.
- Not be blocked by incorrect redirects, firewall rules, or proxy settings.
- Have DNS records that allow the selected Certificate Authority to issue certificates.
If AutoSSL fails, the issue is often related to DNS resolution, domain pointing, HTTP accessibility, or an external DNS/proxy configuration.
Which SSL Verification Type Should You Use?
For most standard hosting accounts, DV with automatic DCV through AutoSSL is enough.
Use DNS validation when:
- The domain is not pointing to the hosting server yet.
- You use external DNS.
- You need a wildcard SSL certificate.
- HTTP validation fails.
Use OV or EV SSL when:
- You need business identity verification.
- Your customers must see that the certificate belongs to a verified organization.
- You operate a financial, legal, enterprise, or high-trust website.
Summary
DCV verifies control of a domain name. It can be completed through HTTP file validation, DNS records, email approval, or automated TLS-based methods.
DV, OV, and EV describe the certificate’s validation level:
| Type | Verifies Domain | Verifies Organization | Common Use |
|---|---|---|---|
| DV | Yes | No | Blogs, basic websites, shared hosting |
| OV | Yes | Yes | Business websites |
| EV | Yes | Yes, with stricter checks | Financial, enterprise, high-trust websites |
For most cPanel users, AutoSSL provides a simple and automatic way to issue and renew DV SSL certificates.
