Adding the DNS Record

Expedited SSL proves you control a name through one CNAME record that you add once. We use it for the first certificate and for every renewal after it.

The record

Your setup page shows the exact name and value for each of your names. The label is unique to that name.

For example, for app.example.com:

_acme-challenge.app.example.com.  CNAME  k3x9q2.acme.expeditedssl.com.

How many records

You add one record per name:

• SSL Single, one hostname (app.example.com): one record, at _acme-challenge.app.example.com.
• SSL Single, a www/apex pair (www.example.com and example.com): two records, at _acme-challenge.www.example.com and _acme-challenge.example.com, each with its own value from your setup page.
• SSL Wildcard (*.example.com and example.com): one record, at _acme-challenge.example.com. It covers both *.example.com and example.com.

Notes for your DNS provider

Your setup page has steps for your DNS provider. In general:

• The Name field. Many DNS editors want only the part before your domain. For _acme-challenge.app.example.com in the example.com zone, enter _acme-challenge.app. If you enter the full name there, some editors save _acme-challenge.app.example.com.example.com.
• The Value field. Some editors add your domain to the end of the value unless it ends with a period. If yours does, enter the value with a trailing period: k3x9q2.acme.expeditedssl.com.
• Proxying. If your DNS provider can proxy records (Cloudflare, for example), set this record to DNS only. A proxied record hides the CNAME, and we can’t see it.
• An existing record at that name. A CNAME can’t share its name with other records. If _acme-challenge.<your name> already has a record from an earlier certificate setup, remove it before you add ours.

Check the record

Your setup page checks for the record and tells you when it sees the right value. Most providers publish changes within a few minutes; some take longer. Once the check passes, we issue and install your certificate.

Keep the record in place

Leave the record in your DNS for as long as you use Expedited SSL. Renewals use it. If you remove it, we can’t renew, and your certificate expires.