Before a certificate authority issues an SSL certificate, it checks that the applicant does indeed have control over the domain. This is known as domain validation (Domain Control Validation, DCV). It is mandatory for all certificates; for domain-validated (DV) certificates, this is the only verification required, whilst for OV and EV certificates, it must be carried out in addition to company verification.

Validation must be repeated with increasing frequency: from 2026, it will be valid for 200 days; from 2027, for 100 days; and from 2029, for just 10 days (see: Why are SSL certificates no longer valid for a year?). It is therefore worth choosing a method that involves minimal manual effort.

Validation takes place automatically for free Let’s Encrypt certificates. This article covers paid certificates, which you set up via the client portal (see: Setting up and reissuing a paid SSL certificate).

Email verification

The certificate authority will send a verification email to one of the domain’s administrative email addresses; by clicking on the link in the email, you can confirm that you have control over the domain. The available email addresses are linked to the domain and are usually:

• admin@pelda.hu
• administrator@pelda.hu
• hostmaster@pelda.hu
• postmaster@pelda.hu
• webmaster@pelda.hu

The verification email cannot be sent to a different address (such as your own Gmail address). If none of these addresses exist, create one in cPanel (see: Creating an email account on cPanel hosting), or set up forwarding to your own email account.

Advantage: there is no need to access the server or DNS. Disadvantage: each request must be manually approved, so the process cannot be automated, and the email may end up in the spam folder.

HTTP or HTTPS file

The certificate authority provides a text file which must be placed on the website at the following path:

http://pelda.hu/.well-known/pki-validation/<fájlnév>.txt

The publisher retrieves this URL, and if the file’s contents match, validation is successful. When an HTTPS file is selected, the same check is carried out at https://; this requires a certificate that is already active on the domain.

• If you have configured the certificate in Autoinstall (via cPanel) mode on the client portal, the system will upload the file automatically; you do not need to do anything.
• For manual configuration, you can download the file from the certificate page using the** ‘Download validation file’** button. On cPanel hosting, create the .well-known/pki-validation/ directory in the website’s root directory (usually public_html) and upload the file there, for example using File Manager.

Advantage: it is quick and fully automated on cPanel hosting. Disadvantage: the domain must already be hosted on the server to which the file is uploaded, and redirects or password protection may prevent verification. It cannot be used with wildcard certificates.

DNS record

The certificate authority provides a DNS record (either a CNAME or TXT record, depending on the type of certificate), which must be created in the domain’s DNS zone. You can find the exact name, type and value on the certificate page of the client portal, under the validation instructions.

• If your domain uses our name servers, you can add the record via the cPanel Zone Editor interface.
• If you manage your DNS elsewhere (for example, with Cloudflare), you will need to set it up there.
• Due to DNS propagation, the record will become visible within a few minutes, or less frequently, within a few hours. You can then request an immediate check by clicking the ‘Revalidate’ button.

Advantage: this is the only method that can be used for wildcard certificates, and the domain does not need to be hosted on the web server (for example, for certificates requested for a mail server or an internal system). The record can also be reused for the next renewal, provided it remains unchanged. Disadvantage: access to the DNS zone is required.

Which one should I choose?

Status	Recommended method
The domain is hosted on our cPanel hosting service	HTTP file in Autoinstall mode (fully automatic)
Wildcard (*.pelda.hu) certificate	DNS record
The certificate is not installed on the web server (email, internal system)	DNS record
You do not have access to either the server or the DNS	Email

You can change the validation method at a later date by clicking the ‘Change Validation Method’ button on the certificate page.