The Trustico® tracking system is where a traditional SSL Certificate license is managed after an order is placed. It is where each SSL Certificate is issued, validated, downloaded, reissued and, when needed, revoked, for the full life of the license.
Managing Each Product Type
Every traditional SSL Certificate license is managed in the tracking system. The ordering and billing systems hold your purchase and invoice records, but they do not handle issuance, reissue, validation or SSL Certificate downloads. View Your Traditional License History 🔗
Certificate as a Service (CaaS) works differently. A Certificate as a Service (CaaS) license is managed entirely by your own Automatic Certificate Management Environment (ACME) client and does not appear in the tracking system. Its own section is near the end of this page.
Opening Your SSL Certificate Dashboard
You open the dashboard with three details from your fulfillment e-mail. These are your Certificate Authority (CA) Reference, the Fully Qualified Domain Name (FQDN) of the SSL Certificate, and which Certificate Authority (CA) issued it, named on the login as Trustico CA or Sectigo CA.
The dashboard for that SSL Certificate license then opens, showing its status and every action available to you. A new traditional license appears in the tracking system within minutes of the order being placed.
Warning : Failure to retain your Certificate Authority (CA) Reference will result in the inability to manage your SSL Certificate and may result in forfeiture. Store this credential securely, as Trustico® cannot recover it on your behalf.
Keep your Certificate Authority (CA) Reference somewhere retrievable. It is the single most important thing to store after ordering, because the dashboard cannot be opened without it.
Express Download
If you only need the SSL Certificate files again, Express Download is the quickest route. Using the same three details, it hands you the files straight away, without opening the full dashboard.
Recent Access History
The login page remembers the last five SSL Certificates opened in that browser, each shown with its Certificate Authority (CA) Reference and issuing Certificate Authority (CA). If you come back on the same device, the right dashboard is a single click away.
Finding Your Certificate Authority (CA) Reference
Your Certificate Authority (CA) Reference is issued by the Certificate Authority (CA) when the order is submitted, and is normally different from your Trustico® order number. It is the identifier that ties every request back to the original SSL Certificate license.
It appears in the automated e-mails sent during ordering, including the shipment notification, where it is shown as the tracking number. It is also added to your invoice a few minutes after payment, and listed against each product in your account when you sign in with the e-mail address used to order. Learn About Reference and Order Number 🔗
If you no longer have it, the lookup tool will find it for you. Enter your order number and the e-mail address the order was placed with.
When they match the record, the details are e-mailed to that address, with a ready login link for each SSL Certificate on the order. For security, nothing is shown on screen, so the details only ever reach the address on the order.
Note : In the legacy system this identifier was called the Supplier Order Number. Older documentation referring to a Supplier Order Number is referring to the same credential now known as your Certificate Authority (CA) Reference.
If your details are rejected, the usual cause is entering the Trustico® order number in place of the Certificate Authority (CA) Reference. An order that has not yet reached the Certificate Authority (CA) also returns nothing, because the reference is created only once the order is submitted.
If you are unsure which number is which, the lookup tool above will e-mail your Certificate Authority (CA) Reference to the address the order was placed with.
Using Your Dashboard
When you access the tracking system dashboard for your license, everything you need to manage it through its term is in one place.
SSL Certificate License Information
The dashboard shows the status of the SSL Certificate, the current SSL Certificate with its validity, the license with its remaining validity, the domains the license covers, and the full issuance history, which can be copied in one click.
Completing Domain Control Validation (DCV)
Validation confirms that you control each domain before an SSL Certificate can be issued. For every domain you choose one of three methods. You can approve by an e-mail sent to an address at the domain, by placing a file on the website, or by adding a Domain Name System (DNS) record.
The tracking system shows the exact value to use for your chosen method, and lets you resend the approver e-mails, retry the check, or switch method at any time. Learn About The Validation Procedure 🔗
The Certificate Authority (CA) Validation Portal
From the dashboard you can open a temporary session to the validation portal operated by the Certificate Authority (CA). It handles more complex validation and is where supporting documents are uploaded, such as for an Organization Validation (OV) or Extended Validation (EV) order.
Trustico® cannot act on your behalf inside it, because validation is carried out by the Certificate Authority (CA).
Resolving a CAA Record Problem
Issuance can be held by a Certification Authority Authorization (CAA) check. A CAA record is not compulsory, but when one is published in your domain's Domain Name System (DNS) it must be valid, or the Certificate Authority (CA) will not issue until it is corrected.
A CAA check also covers other regulatory requirements, so a hold is not always down to a Domain Name System (DNS) record at all. The dashboard explains what needs putting right and lets you request a fresh check once it is resolved. Learn About Certification Authority Authorization (CAA) Records 🔗
Downloading Your SSL Certificate
Once issued, the SSL Certificate can be downloaded in whatever format your server needs : on its own, as the chain of Intermediate Certificates only, with its chain, with its chain and the Root Certificate, as PKCS#7, or as a ZIP file holding every format.
The ZIP file can also be e-mailed to any address you choose. Learn About Intermediate Certificates 🔗
If you placed an AutoCSR order, the unlock code for its archive is shown here as well. Learn About The AutoCSR Unlock Code 🔗
Reissuing Your SSL Certificate
A reissue replaces the current SSL Certificate with a new one on the same license, for the validity remaining. You can keep your existing Certificate Signing Request (CSR) or supply a new one, which is what you do for a new web server or a lost or compromised Private Key.
Validation runs again and the domains stay the same. Your current SSL Certificate keeps working until the new one is issued, so there is no gap in cover. Learn About SSL Certificate Reissue 🔗
Adding a Licensed Domain
A Multi-Domain SSL Certificate can be extended with the additional domains purchased with it, each added as another Subject Alternative Name (SAN). You enter each new domain with the authorization code received at purchase, choose an existing or new Certificate Signing Request (CSR), validate the new domains, and the SSL Certificate is reissued to include them.
Renewing Your License
The dashboard shows how much license validity remains, and when the license is close to its end or has expired it takes you to purchase a new one in the store. Until your first SSL Certificate is issued, it notes that license validity becomes available after issuance. Learn About Renewing Your License 🔗
Revoking Your SSL Certificate
Revoking permanently invalidates an SSL Certificate before its expiry date, for a reason such as a compromised Private Key or an SSL Certificate that is no longer required. It tells every browser and system to stop trusting that SSL Certificate, and it cannot be undone. A routine reissue never requires it.
SSL Certificate Tools
The dashboard links to the Trustico® tools site, which holds the utilities that go with installation, such as converting your SSL Certificate to a PKCS#12 (PFX) file. Explore the Trustico® SSL Certificate Tools 🔗
Collecting an S/MIME Certificate
An S/MIME e-mail Certificate is collected from its own page rather than the SSL Certificate dashboard. You enter your Certificate Authority (CA) Reference, the e-mail address and the issuing Certificate Authority (CA), confirm with a code sent by Short Message Service (SMS), and your S/MIME Certificate status is shown.
You can download the complete bundle, which is the S/MIME Certificate with its Intermediate and Root Certificates and suits most e-mail clients, or the S/MIME Certificate on its own. Explore S/MIME E-Mail Certificates 🔗
License Dates and SSL Certificate Dates
Two separate dates are shown for each SSL Certificate license, and confusing them is a common cause of unexpected expiry. Your license validity is the total period you purchased. Your SSL Certificate validity belongs to the SSL Certificate currently issued under that license.
A website stops being protected on the SSL Certificate expiry date, not on the license expiry date. Where the license runs longer, a reissue is required to continue coverage through the remainder of the term.
The tracking system displays the license validity alongside the validity details of the last SSL Certificate issued from that license.
Keeping Your Own Records
A single license can produce many SSL Certificates over its life, because you may download and reissue as often as you need. Only you know where each one is installed and how many installations exist.
Recording those installations, and the date each SSL Certificate expires, is what keeps a site from going unprotected without warning. Once the license itself expires, no further reissue is possible and a new license is required.
Setting Expiry Reminders
Downloadable calendar files are provided for both the SSL Certificate expiry date and the license expiry date. Adding both to your own calendar takes a moment and removes any reliance on memory.
This matters more than it used to, because shorter validity periods leave far less margin if a date passes unnoticed. Learn About Managing Short Validity Periods 🔗
Important : Customers and partners are responsible for monitoring the expiry dates of installed SSL Certificates. Where several SSL Certificates are in use, dedicated SSL Certificate monitoring software is advisable, so that installed SSL Certificates are detected and alerts are raised before a reissue is due.
Responsibility for keeping an SSL Certificate current rests with its owner, or with the server administrator acting on their behalf.
Programmatic Access Through the Application Programming Interface (API)
Anything that can be viewed or managed against an SSL Certificate license in the tracking system can also be done through the Application Programming Interface (API). This suits customers and partners handling a number of licenses.
Documentation is reached by logging into the tracking system and scrolling to the foot of the page, where a link to a worked example is provided. The example is generated against the SSL Certificate license you are logged into, so the requests and responses show your own details rather than placeholder values.
Application Programming Interface (API) access requires a key, which is issued on request. The same documentation page explains how to make that request.
Certificate as a Service (CaaS) Management
Certificate as a Service (CaaS) subscriptions are not managed through the tracking system. Configuring your Automatic Certificate Management Environment (ACME) client requires your unique External Account Binding (EAB) credentials instead.
These credentials are delivered on ordering and remain available through the portal for a limited period afterward.
Important : Record your External Account Binding (EAB) credentials immediately upon receipt. After seven days these credentials are no longer available through the portal and cannot be regenerated.
Store them securely, since they are needed again whenever an additional Automatic Certificate Management Environment (ACME) client is configured. Learn About Certificate as a Service (CaaS) 🔗
Wildcard
Wildcard
Wildcard
