For many people, SSL\/TLS certificates are an afterthought. A once-every-year-or-so type of product that doesn\u2019t need a whole of explanation beyond \u201chow is it installed?\u201d That\u2019s why seeing terms like \u201cSectigo RSA Domain Validation\u201d can be a little bit confusing. You might know what RSA is, maybe you know about Domain Validation. But not well enough to explain it to anyone.<\/p>\n
<\/p>\n
In this article we\u2019re going to discuss Sectigo RSA Domain Validation<\/strong>, Sectigo RSA Domain Validation certificates<\/strong> and we\u2019ll go over all the terms you\u2019ll need to understand them.<\/p>\n Let\u2019s start by breaking down the term, Sectigo is obviously the CA. It was known as Comodo CA until last Fall, but it\u2019s been around over 20 years. RSA refers to the digital signing algorithm that was used to sign the certificate. And Domain Validation is the level of validation associated with certificates \u2013 it requires a simple domain control check.<\/p>\n Now, Sectigo RSA Domain Validation certificates refers to one of two things: it either refers to the intermediate root that was used to sign the certificate, or it is a type of Sectigo SSL (leaf) certificate \u2013 regardless if it\u2019s a Sectigo, Positive SSL or Essential SSL certificate, it is RSA-signed and Domain Validated.<\/p>\n Let\u2019s start with the Intermediate Root and work our way down the leaf certificates.<\/p>\n The trust model that SSL\/TLS is built on is called PKI or Public Key Infrastructure. It\u2019s a way for clients (internet users) to securely share a secret encryption key with a website (server) so that the two can communicate securely. Before keys can be exchanged though, the client needs to verify the server\u2019s identity. This is where PKI comes in.<\/p>\n That server has an SSL certificate that it will present to the client when it arrives at the website. The client is going to check the digital signature on the certificate and follow it back to the certificate that made it. Anytime a CA issues an SSL\/TLS certificate, it signs that certificate so that clients will know it\u2019s legitimate.<\/p>\n Every client uses a root store that contains a collection of trusted root certificates, these root certificates have been used to sign a series of intermediate root certificates that are in turn used to sign end-user or leaf SSL certificates. To verify the leaf certificate, the client continue following signatures, from the leaf to the intermediate until it arrives at one of the roots in its root store.<\/p>\n Provided the SSL\/TLS certificate is descendant from one of those trusted roots it too will be trusted.<\/p>\n Ok, let\u2019s get back to RSA Domain Validation certificates. One of the intermediate roots that Sectigo uses to sign its leaf SSL\/TLS certificates is the RSA Domain Validation CA certificate. Its key is used to sign all of the Sectigo DV SSL certificates that use RSA signatures.<\/p>\n Now let\u2019s talk about digital signatures for a second.<\/p>\n For all intents and purposes there are two different signing schemes in use today. RSA is the most common, and then there\u2019s DSA or Digital Signing Algorithm, which is now primarily performed using Elliptic Curve Cryptography and abbreviated ECDSA.<\/p>\n Though it\u2019s a bit archaic now, some people refer to SSL certificate types by their signing algorithm. So you may hear it\u2019s an RSA SSL\/TLS certificate or an ECDSA\/ECC one. This refers to the type of digital signature.<\/p>\n So, circling back to Sectigo RSA Domain Validation, the Sectigo RSA Domain Validation CA certificate is the intermediate root that\u2019s been spun up to sign Sectigo DV SSL certificates with RSA signatures. There\u2019s also a Sectigo ECDSA Domain Validation CA certificate that signs Elliptic Curve signatures on DV certificates.<\/p>\n It\u2019s likely that this is the context you were querying \u201cSectigo RSA Domain Validation\u201d for on Google. If that\u2019s the case, you\u2019re likely getting an error that this certificate is missing, you may also be getting a certificate chaining error.<\/p>\n Here\u2019s a link to the Sectigo RSA Domain Validation CA certificate.<\/p>\n We offer the best discount on all types of Sectigo SSL Certificates. It includes Sectigo Wildcard SSL, EV SSL, Multi-Domain SAN\/UCC SSL, and Code Signing Certificates.<\/p>\n Shop Sectigo SSL Certificates and Save Up to 89%<\/a><\/p>\n<\/div>\n Here\u2019s why you\u2019re having the problem: As we just discussed, in order for a leaf SSL\/TLS certificate to be trusted, the client needs to be able to chain it back to its root store. But CAs almost never sign directly off their root certificates, that exposes them to undue risk \u2013 so instead they spin up intermediate root certificates and use those to sign.<\/p>\n This is why you\u2019re sometimes sent an additional \u201cIntermediate\u201d certificate when you receive your leaf SSL\/TLS certificate. Your server will need to present the client with this additional intermediate in order to build the certificate chain that\u2019s requisite for the client to trust the leaf certificate. Some browsers will cache intermediate certificates in case a server doesn\u2019t send everything it needs to complete the chain, so it\u2019s possible you installed your SSL\/TLS certificate months ago and this was never an issue until someone using an older browser tried to reach your site.<\/p>\n The fix is easy if you\u2019re server-side, just install the Sectigo RSA Domain Validation intermediate and you should have no more problems.<\/p>\n If you\u2019re client-side there is a way for you to add the Sectigo RSA Domain Validation certificate to your root store so that you can avoid this error and any others like it in the future, but first a word of caution: while this might fix your problem in the interim, you\u2019re not helping the security ecosystem by covering for other websites\u2019 mistakes. The best course of action would be to notify the site owner and let them fix it. It\u2019s their problem, after all.<\/p>\n We offer the best discount on all types of wildcard SSL Certificates with DV and OV validation. We offer wildcard certificates from the leading CAs, including Comodo CA, Sectigo, Thawte, GeoTrust, and RapidSSL starting for as little as $52.95 per year.<\/p>\n Shop Cheap Wildcard SSL Certificates<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":" Understanding key terminology is key to understanding SSL\/TLS For many people, SSL\/TLS certificates are an afterthought. A once-every-year-or-so type of product that doesn\u2019t need a whole of explanation beyond \u201chow is it installed?\u201d That\u2019s why seeing terms like \u201cSectigo RSA … Continue reading Sectigo RSA Domain Validation<\/h2>\n
A quick trip through PKI<\/h2>\n
Back to RSA Signatures<\/h2>\n
RSA Domain Validation Intermediate Roots<\/h2>\n
Purchase Sectigo SSL Certificates & Save Up to 89%<\/h2>\n
Why you\u2019re having this problem<\/h2>\n
Purchase a Wildcard SSL Certificate & Save Up to 73%!<\/h2>\n