Summary: Industry regulations require Certificate Authorities (CAs) to shorten the reuse period for Domain Control Validation (DCV). This means domain verification must be completed more frequently throughout the lifecycle of your SSL certificates. To help streamline these ongoing requirements, ClickHere2 Network offers SSL certificates with ACME and AutoInstall automation.
What Is Domain Control Validation (DCV)?
Before issuing or reissuing any SSL/TLS certificate, a Certificate Authority (such as DigiCert, Sectigo, Thawte, or Comodo) must verify that the applicant genuinely controls the domain names listed on the certificate. This mandatory security check is known as Domain Control Validation (DCV).
DCV is typically completed using one of three standard methods:
-
Email Validation: Approving an authorization email sent to an administrative contact (such as
admin@,webmaster@, orhostmaster@yourdomain.com). -
DNS TXT Record: Adding a unique verification token provided by the CA to your domain's public DNS zone.
-
HTTP/HTTPS File Hash: Uploading a designated verification file containing authentication tokens to a specific directory (
/.well-known/pki-validation/) on your web server.
Historically, once a domain was validated, CAs could reuse that validation result for up to 398 days across certificate reissues, renewals, or new orders for the same domain without requiring you to re-verify domain ownership each time.
Industry Changes: Why DCV Validity Is Decreasing
To improve internet security and ensure that digital certificates are only held by active, legitimate domain owners, the CA/Browser Forum (the global standards body governing public SSL certificates) passed Ballot SC-081v3.
This ballot introduces a staged timeline that significantly reduces how long a completed DCV verification remains valid for reuse. These rules apply across all publicly trusted Certificate Authorities worldwide.
As DCV validity decreases, domain control must be re-verified more frequently:
| Effective Date | Maximum DCV Reuse Period | Maximum Certificate Validity | Practical Impact on Site Owners |
|---|---|---|---|
|
Prior to 15 March 2026
|
398 days
|
398 days (~1 year)
|
Domain verified approximately once per year.
|
|
From 15 March 2026
|
200 days
|
200 days
|
Multi-year certificate subscriptions require re-validation at least twice a year.
|
|
From 15 March 2027
|
100 days
|
100 days
|
Validation required approximately every 3 months.
|
|
From 15 March 2029
|
10 days
|
47 days
|
Continuous or automated validation required.
|
Note: These figures represent the maximum limits allowed by industry standards. Individual Certificate Authorities may enforce shorter limits according to their internal security policies.
Streamlining Management: ACME and AutoInstall Automation
Manually approving validation emails or creating DNS records multiple times per year increases administrative overhead and introduces the risk of unexpected certificate expiration if a notice is missed.
To address this challenge, ClickHere2 Network offers SSL certificates supported by ACME and AutoInstall automation:
-
ACME (Automated Certificate Management Environment):
An industry-standard communication protocol that automates the exchange between your web server and the Certificate Authority. ACME automatically fulfils domain control challenges (such as updating DNS or HTTP verification tokens), requests issuance, and fetches renewals without requiring manual intervention for each validation cycle. -
AutoInstall Automation:
While standard issuance leaves the deployment step to server administrators, AutoInstall connects with supported hosting platforms to automatically bind and activate the newly issued certificate on your web server. This ensures that certificates are immediately active in production rather than awaiting manual installation.
Together, ACME and AutoInstall provide an end-to-end hands-off workflow, ensuring your websites remain continuously secured with modern, compliant SSL certificates even as re-validation cycles become more frequent.
Organization Validation (OV) and Extended Validation (EV) Considerations
While automated DCV simplifies domain verification, business-validated certificates carry additional requirements:
-
Domain Control Validation: ACME automation can fulfil the domain verification portion of OV and EV certificates.
-
Organization & Identity Vetting: The legal existence, physical address, and telephone verification of your business or organization must still be validated directly with the CA according to established industry schedules.
-
Callback Verification: Authorized representatives must still respond to periodic verification telephone calls from the Certificate Authority.
Best Practices for Managing Your SSL Certificates
To maintain uninterrupted encryption across your websites and web services:
-
Keep Contact Information Current: Ensure the administrative email addresses associated with your domain and your ClickHere2 Network account are active and monitored regularly.
-
Maintain Administrative Access to DNS: If you validate domains using DNS TXT records, ensure your team retains administrative access to your DNS management console so records can be updated quickly when required.
-
Plan Renewals Early: Because multi-year subscription certificates require periodic re-validation before a new certificate can be issued, begin validation steps as soon as you receive renewal notices.
-
Transition to Automation: Where supported by your hosting environment, evaluate adopting certificates with ACME and AutoInstall capabilities to minimize ongoing manual maintenance.
For guidance on selecting the right SSL certificates or configuring ACME and AutoInstall automation for your domains, contact ClickHere2 Network support.
