Multi-Domain SSL Certificates

Best Practice: DNS-Based DCV (Recommended)

We strongly recommend using DNS-based validation. It’s secure, reliable, and easier to automate in preparation for shorter certificate lifespans. There are two supported DNS-based options:

1. DNS CNAME-based DCV
A CNAME record is added to your DNS pointing to a validation target provided by the certificate authority.

2. DNS TXT-based DCV (Random Value Method)
You’ll add a TXT record containing a random value to your domain’s DNS. The record should follow this format:

• Name: _pki-validation.your-domain.com
• Type: TXT
• Value: <random_value_provided>

The random value is unique to your order and valid for 30 days. Once added, Sectigo will check for the presence of the TXT record to confirm domain control.

Alternative: Email-Based DCV (Pre-Approved Addresses Only)

Email-based authentication remains supported but is now limited to the following pre-approved addresses. WHOIS-based email addresses are no longer accepted as of June 15, 2025:

• admin@your‑domain.com
• administrator@your‑domain.com
• webmaster@your‑domain.com
• hostmaster@your‑domain.com
• postmaster@your‑domain.com

We will send an authorization email to one of these addresses. Once you respond and confirm ownership, the certificate can be issued within minutes of a completed order.

If the email Domain Validation does not work for your particular situation, there are alternative methods.

• File-Based Authentication – Sectigo will provide you with a text file that you will need to upload to the root directory of your website. We will then verify your websites via HTTP or HTTPS.

• CNAME-Based Authentication – Sectigo will provide you with two unique hash values (these are MD5 and SHA1). You, in turn, must enter them in your CNAME DNS record.

Organization Validated SSL certificates for multiple domains require more validation than Domain Validated ones and provide more trust. With an OV certificate, we confirm the business associated with the domain names is registered and legitimate by checking details such as the company name, location, address, and incorporation or registration information. This makes the certificate a more suitable option for public-facing websites that represent companies or organizations. OV's are usually used by corporations, governments, and other entities that want to provide an extra layer of confidence to their website visitors.

Organization Validation requirements for an organization include:

• Domain Ownership/Authentication

• Organization Authentication

• Locality Presence

• Telephone Verification (Organization phone number found on an online database

• Final Verification phone call

For legitimate organizations, this process goes smoothly and quickly. Remember, an OV certificate differentiates legitimate businesses from the pretenders—including scammers and hackers.

An OV SSL certificate for an individual requires the identity and address to be validated on the certificate. Individual identity is verified by providing one of the following documents:

• Legible copy of a government-issued photo ID such as a valid driver's license, passport, military ID, or National ID

• Copy of a recent major utility bill (i.e. power

• Copy of a bank or credit card statement

The Extended Validation SSL certificate adheres to strict industry guidelines, but our validation specialists simplify the process to require minimal action on your part. This level of security is recommended for sites that obtain personal information from users, such as eCommerce websites.

The validation of your organization can be completed using 1 of 3 methods:

• DCV email

• CNAME

• HTTP(S) challenge

Anticipate a telephone call to the main business phone number listed on the subscriber agreement to verify the signature, authority to sign and signer's title. If any additional actions are required a validation specialist will reach out to you via email. The telephone call to verify the authenticity of the order and signer listed on subscriber agreement can not be made to a direct phone number or cell phone unless the number can be validated.

Tips When Validating

• Sole proprietorship / sole trader and some partnerships require a principal individual in the organization to be verified.

• All EV certificates must have the legal name. If a tradename/DBA is verified, the certificate will be listed with the tradename and legal name.

• In the case of a sole trader, the legal name is the owner/principal name.

• No certificate can be issued to the tradename/DBA name only.

• Use the address where the organization conducts business. Do not use a PO Box, Care of, mail stop/forwarding, virtual office or a registered agent address.

• If the Validation Specialist is not able to verify your organization, you will be contacted with options on how to resolve any outstanding issues.

A multi-domain SSL certificate can secure multiple primary domains while a wildcard SSL certificate secures one primary domain and its associated subdomains under the same top-level domain.

Sectigo offers multiple plan options, depending on your needs, starting at $308 for a 1-year Multi-domain DV SSL, $575 for an OV, and $748 for EV. The prices decrease with multi-year subscription options.

Multi‑year certificates provide upfront savings and predictable pricing while helping you stay ahead of industry‑mandated certificate lifespan changes. 

Due to evolving browser and CA requirements, SSL/TLS certificates are now issued with shorter validity periods (currently up to 199 days), which means certificates must be reissued more frequently within the subscription term. With a multi‑year plan, you lock in today’s lowest price and maintain uninterrupted coverage for the full subscription period—without needing to repurchase each time a certificate is reissued. 

As certificate lifespans continue to shrink toward the upcoming 47‑day standard, multi‑year subscriptions offer a simpler, more cost‑effective way to manage frequent reissuance while maintaining continuous security. 

Learn more about the industry’s move to 47‑day SSL certificates: https://www.sectigo.com/47-day-ssl