Ordering DV Wildcard SSL Certificate

What Is a Wildcard Certificate?

A Wildcard SSL certificate secures your main domain and every subdomain under it - all with a single certificate. Instead of buying separate certificates for shop.yourdomain.com, mail.yourdomain.com, and portal.yourdomain.com, one Wildcard certificate covers all of them at once.

The wildcard domain is written as *`.yourdomain.com** - the asterisk (*`) acts as a placeholder for any subdomain name.

Example: A certificate for *.mybusiness.com automatically secures:

- shop.mybusiness.com

- mail.mybusiness.com

- portal.mybusiness.com

- api.mybusiness.com

- and any other subdomain you create now or in the future.

⚠️ Important limitation: A Wildcard covers only one level of subdomains. It does NOT automatically cover sub-sub-domains. For example, *.mybusiness.com does NOT cover dev.shop.mybusiness.com. If you need to cover deeper levels, additional certificates are required.

What You Will Need Before You Start

Before beginning, please have the following ready:

• Your CERTInext login credentials (email and password)

• Your wildcard domain name in the format *.yourdomain.com (e.g., *.mybusiness.com)

• A CSR (Certificate Signing Request) generated with *.yourdomain.com as the Common Name - see Step 2 for full guidance. Your IT team or hosting provider can generate this for you.

• Access to your domain's DNS settings - needed for domain validation after you apply. DNS-based validation (adding a TXT record) is the recommended method for wildcard certificates.

📌 InCommon Users: If your institution is part of the InCommon Certificate Service programme, your login process and group assignment may be pre-configured by your institution's IT administrator. The application steps shown in this guide are the same for InCommon users. Your subscription cost may be covered under your institutional InCommon agreement - certificates may appear at $0.00 or at a flat negotiated rate. Check with your IT/PKI administrator before proceeding.

Overview - The Complete Journey

Ordering a DV Wildcard SSL certificate on CERTInext involves two main phases:

Phase 1 - Application in CERTInext (6 Steps):

You fill in a 6-step wizard and make payment.

Phase 2 - Post-Submission Actions (via emSign Subscriber Portal):

After payment, you complete domain validation and download your certificate - guided by emails and a dedicated tracking portal.

The entire process, from application to certificate in hand, can take as little as 15–30 minutes for a DV Wildcard certificate if your domain DNS access is ready.

PHASE 1 - APPLYING FOR THE CERTIFICATE IN CERTInext

Step 1 - Choose Product & Validity

What you see: The first screen of the certificate application wizard. This is where you select the certificate product and how long you need it to be valid.

How to get here

1. Log in to CERTInext.

2. Click the "NEW CERTIFICATE" button in the dark sidebar on the left.

3. The screen titled "Certificates :: New Request" opens.

4. The left panel shows all 6 steps. You start at Step 1: "Choose Product & Validity".

Fields on this screen

Field	What It Is	What to Do
Group	The account/organisation in CERTInext that will own this certificate and be billed for it.	This is pre-filled. Confirm it shows your correct organisation name.
CA Source	The Certificate Authority (CA) that will issue your certificate.	Select emSign from the dropdown.
Certificate Type	The category of certificate.	Select SSL/TLS Certificates from the dropdown.
Product	The specific certificate product.	Select DV SSL Certificate Wildcard.
Subscription For	How long the certificate will be valid. Three radio button options are shown.	Select 1 Year Subscription, 2 Years Subscription, or 3 Years Subscription based on your need. Most users choose 1 year.
Cost	The price calculated automatically based on your product and validity selection.	Review the displayed amount in USD. The cost for a DV SSL Certificate Wildcard is shown on screen. Sales tax (if applicable) is added at checkout.

The Blue Information Box

When you select the DV SSL Certificate Wildcard product, a blue information panel appears at the bottom of the screen. It describes what the product covers:

• Secures your domain and all its subdomains (*.yourdomain.com)

• Domain Validation - automated and fast

• Fully Automated & Instant Approval

• Average Issuance Timeframe will be in Minutes

• Unlimited Server Licences

• Strongest SHA2 & ECC Encryption

• Major Browser & Mobile Device Compatibility

• Automatic renewal reminders and early renewal options

📌 InCommon Users: Under "Subscription For", you will see the same 1/2/3 year options. InCommon institutional agreements typically issue DV Wildcard certificates for 1 year at a time (in line with CA/Browser Forum rules for maximum certificate validity). Even though your institution's InCommon contract may run for multiple years, each individual certificate is issued for a maximum of 1 year and must be renewed annually. The auto-renew feature (set in Step 5) handles this automatically.

When done, click the Next button at the bottom right.

Step 2 - Certificate Signing Request (CSR)

What you see: A screen where you provide the CSR - a technical file from your web server that the CA uses to create your certificate.

What is a CSR?

A CSR (Certificate Signing Request) is a block of text generated by your web server. It contains your domain name (called the Common Name) and a public key. The CA uses it to create your certificate. Your IT team, hosting provider, or server administrator can generate this for you.

⚠️ Critical for Wildcard Certificates - The Common Name MUST include the asterisk: When your IT team generates the CSR, they must set the Common Name (CN) to *.yourdomain.com - with the asterisk and dot at the front. For example: *.mybusiness.com. A CSR generated for mybusiness.com (without the asterisk) will NOT work for a Wildcard certificate.

⚠️ Key Size - Use 4096-bit: When generating the CSR for a Wildcard certificate, use a 4096-bit RSA key for stronger security. This is the recommended key size for Wildcard certificates. Ask your IT team to set the key size to 4096 bits when generating the CSR. The screenshot of the completed order view will confirm the key size was correctly set to 4096.

⚠️ Important note shown on screen: "The public key and signature algorithm from your CSR are used for certificate generation. Subject details such as Organisation, Country, and State are pre-filled from your CSR for convenience but can be edited. The values you submit in the form will be the final values in the issued certificate."

This means: what you type on the form is what will appear in your issued certificate - not necessarily what was in the CSR.

Your Three Options

Option A - Upload CSR File

1. Click the "Choose File" button next to "Upload CSR".

2. A file browser opens. Navigate to your .csr or .pem file on your computer.

3. Select the file. The filename appears next to the button once selected.

Option B - Paste CSR Text

1. Open your CSR file in a text editor (Notepad, TextEdit, etc.).

2. Copy everything - the entire block starting with -----BEGIN CERTIFICATE REQUEST----- and ending with -----END CERTIFICATE REQUEST-----, including those header and footer lines.

3. Paste the copied text into the "Paste CSR" text box on screen.

4. The text box shows the CSR block once pasted.

Option C - Skip CSR

1. Tick the "Skip CSR" checkbox at the top of the screen.

2. You can complete the order and pay now, then provide the CSR later.

3. Use this if your IT team hasn't generated the Wildcard CSR yet but you need to start the order.

⚠️ Tip: If you are using a control panel (e.g., cPanel, Plesk), log in to your hosting control panel, go to SSL/TLS settings, and generate a CSR from there. When prompted for a domain name or Common Name, enter *.yourdomain.com with the asterisk. Set the key size to 4096 bits. Copy and paste the generated CSR text into the Paste CSR box.

Click the Back button to go back, or Next to proceed.

Step 3 - Certificate Requestor Information

What you see: A screen titled "Certificate Requestor Information" where you confirm the details of the person placing this order.

Fields on this screen

Field	What It Is	What to Do
Name (required - marked with )*	Your full name as the person requesting this certificate.	Pre-filled from your account profile. Verify it is your correct full name.
Requestor Email ID (required - marked with )*	The email address that will receive all notifications about this order - order confirmation, domain validation requests, and the certificate issuance notification.	Pre-filled from your account. Make sure this is a monitored inbox - you will need to act on emails sent here.
Mobile Number	Your contact phone number. The country code is selected from a dropdown.	Pre-filled from your account. Update if your number has changed.
CERTIFICATE DOWNLOAD DELEGATION (section header with ℹ️)	This optional section lets you authorise another person to download the certificate on your behalf. Useful if the person applying is different from the IT person who will install the certificate.	Only fill this in if a different person should handle the certificate download.
Contact Name (under delegation - optional)	Full name of the person you are delegating download access to (e.g., your server administrator).	Leave blank if only you will download the certificate.
Email ID (under delegation - optional)	Email address of the delegated person. They will also receive the certificate issuance email.	Leave blank if not needed.

📌 Tip: If you are applying for a certificate on behalf of someone else (e.g., a client or colleague), enter your own details as the Requestor, and use the Certificate Download Delegation fields to ensure the certificate recipient also gets notified and can download it.

Click Back to go back, or Next to proceed.

Step 4 - Certificate Information

What you see: A screen titled "Certificate Information" where you enter the wildcard domain name that the certificate will protect.

What Is Different About This Step for Wildcard Certificates

Unlike the standard DV SSL Certificate, the DV Wildcard certificate does not have the "Automatically secure 'www' variant" checkbox. This is by design: a wildcard certificate already covers ALL subdomains - www.yourdomain.com is automatically included as a subdomain. There is no need for a separate checkbox.

Fields on this screen

Field	What It Is	What to Do
Domain Name (required - marked with )*	The wildcard domain name this certificate will secure. This must include the asterisk and dot at the front.	Type your domain name in the format *.yourdomain.com. The asterisk and dot are required. Example: *.mybusiness.com

⚠️ Critical - Enter the Domain in the Correct Wildcard Format: You must enter the domain name exactly as *.yourdomain.com (with the asterisk-dot prefix). Do not enter yourdomain.com or www.yourdomain.com. The asterisk tells the system this is a Wildcard certificate.

⚠️ The wildcard domain name must match the Common Name (CN) in your CSR. If your CSR was generated for *.mybusiness.com, you must enter *.mybusiness.com here. If they don't match, the Certificate Authority will reject the request.

*What `.yourdomain.com` covers:**

- shop.yourdomain.com ✅

- mail.yourdomain.com ✅

- api.yourdomain.com ✅

- yourdomain.com (bare domain) - not covered automatically - install separately if needed

Click Back to go back, or Next to proceed.

Step 5 - Additional Information (Optional)

What you see: A screen titled "Additional Information" with optional fields that help with managing and administering the certificate. None of these are required to get the certificate issued - but some are very useful.

Fields on this screen

Field	What It Is	What to Do
Tags (with ℹ️ and "+ Add Tag" button)	Labels you can attach to this certificate order for your own internal organisation and searching.	Click + Add Tag and type a label (e.g., "Wildcard", "Production", "All Subdomains"). Leave blank if not needed.
Order Remarks	A free-text field for internal notes about this order. Not visible to the CA.	Type any notes that will help you remember why this order was placed. Leave blank if not needed.
Technical Point of Contact Information (checkbox with ℹ️)	When ticked, expands to show fields for a technical contact person (e.g., your server administrator).	Tick and fill in if you want to record your IT contact's details. Leave unticked if not needed.
KYC Documents (checkbox with ℹ️)	When ticked, lets you upload identity or business verification documents.	Tick only if you have been asked to provide KYC documents. For standard DV Wildcard certificates, this is usually not required.
Additional email recipients (checkbox)	When ticked, lets you add more email addresses to receive certificate notifications.	Tick and add emails if your manager, IT team, or a client also needs to receive notifications.
Auto-renew certificates until coverage (checkbox with ℹ️ - ticked by default)	When ON, CERTInext automatically starts the renewal process before your certificate expires.	Leave this ON (it is ticked by default). Highly recommended for all users.
Set renew criteria: Before ___ days of certificate expiry	How many days before expiry the auto-renewal process will trigger. Default is 15 days.	Leave at 15 days unless you have a specific reason to change it.

📌 InCommon Users: The auto-renew feature works the same way for InCommon Wildcard certificates. Since InCommon DV certificates are valid for 30 days / 90 days / 199 days, the auto-renewal will trigger 15 days before the 1-year mark. Make sure your institutional InCommon agreement is still active at renewal time so the renewed certificate is also covered.

📌 Tip: Add a Tag such as "Wildcard - Production" to make this certificate easy to identify among your orders, especially if you manage multiple certificates.

Click Back to go back, or Next to proceed to the Order Summary.

Step 6 - Order Summary & Payment

What you see: The final screen before submitting your order. It shows a complete summary of everything you have entered, along with the payment breakdown.

Notice: An orange "Payment Pending" badge appears in the top-right corner - this confirms the order has not yet been paid.

What Is Shown on This Screen

Product Information section:

Item	Value
Certificate Type	SSL/TLS Certificates
Product Name	DV SSL Certificate Wildcard
Validity Period	1 Year (or whichever you selected)
Domain Count	1

Certificate Information section:

Shows the wildcard domain name you entered in Step 4 (e.g., *.mybusiness.com) - confirm this is correct before paying.

Payment Information section:

Item	Description
Current Balance	Your account's pre-loaded credit balance in USD. This is your organisation's available credit in CERTInext.
Cost	The base price of the DV SSL Certificate Wildcard in USD, as shown on screen.
Tax	Applicable sales tax (if any) based on your account's billing region.
Grand Total	The final amount you will pay: Base Cost + any applicable tax.

Important notice on screen:

"On click of Use Credits button, amount will be deducted from your account balance."

This means if you click Use Credit, the Grand Total will be deducted from your organisation's pre-loaded balance - no separate card payment needed.

The Subscriber Agreement Checkbox

⚠️ You MUST tick this checkbox before you can pay. The checkbox text reads: "The Subscriber/Requestor hereby agrees to have read, understood and agree to Subscriber Agreement of emSign."

By ticking this, you are legally agreeing to the terms and conditions of the emSign Certificate Authority for issuing this certificate. Click the "Subscriber Agreement" link in the text to read the full terms before ticking.

Payment Buttons

Button	What It Does
Save and Exit	Saves your order as a draft. No payment is made. Status will show "Payment Pending". You can return to complete payment later.
Pay Online	Opens a payment gateway. Pay using a debit card, credit card, or other available methods.
Use Credit	Instantly deducts the Grand Total from your organisation's CERTInext credit balance. Most common option for enterprise accounts. No card details required.

📌 InCommon Users: If your InCommon Wildcard certificate is included under an institutional subscription, the cost shown may be $0.00 or a flat institutional rate. Click Use Credit to proceed. If the cost appears unexpectedly high, contact your IT administrator before paying - the pricing configuration may need to be verified with your InCommon account manager.

Once you click Use Credit or Pay Online and the payment is processed, your order is submitted. You will be taken to the Order Confirmation screen and will receive a confirmation email. Do not close the browser immediately - wait for the confirmation screen to load.

PHASE 2 - POST-SUBMISSION: WHAT HAPPENS AFTER YOU PAY

Immediately After Payment - The Order View Screen in CERTInext

What you see: The "Certificates :: Orders > View Order" page opens automatically after payment. This page shows the complete record of your order.

The Order Header Bar

At the very top of the page, a summary bar shows:

Item	What It Means
Order ID	A unique number for your order. Keep this for your records and for any support queries.
Ordered Date	The date and time your order was placed.
Product	DV SSL Certificate Wildcard.
Group	Your organisation's account name in CERTInext.
CA Source	The issuing CA: emSign.
Certificate Price	The total amount charged in USD.
Order Status	Shows "Order Accepted" in an orange badge - payment received, order is in the system, awaiting internal approval.
Certificate Status	Shows "Pending for Approver" in an orange badge - your CERTInext account administrator must review and approve the order before emSign begins processing it.

⚠️ Important - Pending for Approver: In enterprise CERTInext accounts, every new certificate order must be approved by an Account Administrator before it is forwarded to emSign. If you are the Administrator, you can approve it yourself from this page using the 3-dot menu (⋮) in the top-right corner. If you are not the Administrator, contact your IT department or CERTInext account manager and ask them to approve your order by Order ID.

What the Rest of the Order View Page Shows

The page is divided into several information panels:

SSL Subscription Information:

• Subscription For: 1 year

• Subscription Start Date / End Date: Shown as "–" (dashes) at this stage because the certificate has not yet been issued

• Subscription Status: Pending (orange) - will change to Active once issued

Auto-Renewal Configuration:

• Confirms that auto-renew is set to Yes, triggering 15 days before expiry

Certificate Information:

• Shows your wildcard domain name (e.g., *.mybusiness.com)

Certificate Requestor Information:

• Confirms Name, Email, and Mobile Number from Step 3

Certificate Signing Request (CSR) Information:

• CN: Your wildcard domain name, e.g., *.mybusiness.com

• Key Size: 4096 - confirms the strong 4096-bit RSA key from the CSR you provided

• Key Algorithm: RSA

Ordered By:

• Shows the name of the user who placed the order and their role

Renewal Notifications:

• Send email notifications: Yes - you will receive reminder emails before the certificate expires

Reissue History:

• "No records found" - as expected for a brand-new order

📌 The 3-dot menu (⋮) in the top-right corner of the order page gives Administrators access to actions including: Download Certificate, Reissue Certificate, Track Order, Download Invoice, Replace CSR, Recall Request, and Cancel Order. The "Download Certificate" option becomes active once the certificate is issued. The "Reissue Certificate" option allows you to reissue the certificate (for example, if you need to update the CSR) within the same validity period.

Email 1 - Order Confirmation: "Your Order is Successful"

What you see: Shortly after payment, you receive an email at the Requestor Email ID you provided in Step 3.

Email Subject: ORDER #[your order ID] - Your Order is Successful

Email Content:

Field	Value
Greeting	Dear [Your Name], / Your order is placed successfully.
Order ID	Your unique order number
Ordered Date	Date and time of the order in UTC
Product & Validity	DV SSL Certificate Wildcard
Identifier	Your wildcard domain name (e.g., *.mybusiness.com)
Subscription For	1 Year(s)

The orange "Track Order" button in the email is your key to the next stage. Clicking it takes you to the emSign Subscriber Portal - a separate web page where you complete the remaining steps: domain validation and certificate download.

⚠️ Do not ignore this email. The Track Order link is how you complete the domain validation step. Without completing domain validation, your certificate cannot be issued.

📌 Check your spam/junk folder if you do not see this email within a few minutes of payment. The email is sent from emSign (emudhra.com domain). Add the sender to your safe senders list to avoid future emails going to spam.

Contact details at the bottom of the email:

The email shows a support email address and phone number. Use these if you need help.

The emSign Subscriber Portal - Your Order Tracking Hub

What you see: Clicking the "Track Order" button in the confirmation email opens the emSign Subscriber Portal - a dedicated, public-facing page that guides you through the remaining steps to get your certificate issued.

Page Header: "Hello [Your Name], Please follow the instructions and complete the below verification steps to speed up your certificate issuance process."

The Four Order Actions

This page shows four steps that must be completed, in the Order Actions section:

#	Action	Status at This Stage
1. Submit CSR	Confirming your CSR has been provided	✅ Completed (green)
2. Subscriber Agreement	Confirming you accepted the subscriber agreement at payment	✅ Completed (green)
3. Domain Verification	Proving to the CA that you own/control the domain	🟠 Awaiting Customer Action (orange) - you must complete this
4. Certificate Download	Downloading the issued certificate	🟠 Issuance Pending (orange) - will be available once Step 3 is done

The Order Details Sidebar (right side of page)

Item	What It Shows
Date Ordered	Date you placed the order
Order ID	Your unique reference number
Product & Validity	DV SSL Certificate Wildcard
Domain Name	Your wildcard domain (e.g., *.mybusiness.com)
Order Status	Order Accepted
Certificate Status	Pending for Approver

📌 InCommon Users: The emSign Subscriber Portal is the same for all users, including InCommon. Domain verification is required for all wildcard DV certificates regardless of your InCommon membership status. You must prove control of your domain to receive the certificate.

📌 You can always come back to this page by clicking the Track Order button in the confirmation email, or by generating the tracking URL from within CERTInext (3-dot menu → Track Order).

Completing Domain Verification (Step 3 on the emSign Portal)

What you see: Clicking on the "3. Domain Verification" row (or the "+" expand icon on the left) expands a section showing your wildcard domain and the domain validation controls.

What You See When Expanded

• Total Domains: 1 - confirms one domain needs to be validated (your wildcard domain, e.g., *.mybusiness.com)

• Under Domain Control Validation (DCV), your wildcard domain name is listed with two buttons:

– CAA - for checking the Certification Authority Authorisation record (advanced, typically for IT teams)

– Verify - the button you click to start domain validation

DCV Instructions (shown on the page):

"A Domain Control Validation or DCV must be completed before issuing an SSL/TLS certificate."

"Please click 'Verify Domain' against each domain name to select a DCV method and prove control over each domain."

How to Start - Click the "Verify" Button

Click the orange "Verify" button next to your wildcard domain name. A popup window opens, titled:

"Domain Control Validation ([your domain]) – #[Order ID]"

⚠️ Note shown in the popup: "This is technical in nature (if you are not the right person, please contact your IT / Domain administrator)."

If you are not the person who manages your domain's DNS or web server, stop here and forward the tracking URL to your IT or domain administrator and ask them to complete the domain verification step.

Choosing a DCV Method

The popup shows a DCV Method dropdown with two options. For Wildcard certificates, DNS TXT Record is strongly recommended and is typically the only suitable method.

⚠️ Wildcard Certificates and DCV Methods: The HTTP/HTTPS file-based validation method works for specific Fully Qualified Domain Names (FQDNs) only. For a wildcard domain like *.mybusiness.com, you should use the DNS TXT Record method. The DNS TXT method proves control of the base domain, which covers the wildcard.

Method 1: DNS TXT Record (Most Preferred - Strongly Recommended for Wildcards)

Select "DNS TXT Record (Most Preferred)" from the DCV Method dropdown.

The popup shows a table with a record to add to your DNS:

Record Type	Host	Value
TXT	Your base domain name (e.g., mybusiness.com)	A unique alphanumeric token

Both the Host and Value fields have "Copy" buttons next to them - click these to copy the exact values.

Step-by-step instructions:

1. Log in to your domain registrar or DNS provider (e.g., GoDaddy, Cloudflare, Namecheap, Google Domains).

2. Navigate to the DNS Management section for your domain.

3. Add a new TXT record with:

– Host/Name: Copy the Host value from the popup (it may be your full domain name or just @ depending on your provider)

– Value/Content: Copy the long alphanumeric token from the popup

– TTL: Set to the minimum available (e.g., 300 seconds / 5 minutes) for fastest propagation

4. Save the DNS record.

5. Wait 5–30 minutes for the DNS record to propagate (may take up to 48 hours in rare cases).

6. Return to the popup and click "Verify Now" (orange button).

7. If successful, the popup confirms domain ownership.

📌 InCommon Users: The DNS TXT record method is the most reliable and is recommended for InCommon institutional Wildcard certificates. If your domain is managed by your institution's IT department, provide them with the Host and Value shown in the popup and ask them to add the TXT record.

Method 2: HTTP/HTTPS File-Based Validation

Select "HTTP/HTTPS File-based" from the DCV Method dropdown.

⚠️ Note shown in the popup: "File-based (HTTP/HTTPS URL) DCV method can only be used to prove domain ownership over Fully Qualified Domain Names (FQDNs), exactly as named."

For Wildcard certificates, use the DNS TXT Record method instead. File-based validation is not suitable for proving wildcard domain ownership. Use this method only if specifically directed by your administrator.

If you must use file-based validation, the popup shows:

Item	Detail
File Name	A specific filename ending in .txt - with a Copy button
File Content	A unique token string - with a Copy button

Upload the file to your web server at the path shown in the popup, then click "Verify Now".

After Domain Verification Succeeds

Once you click Verify Now and the CA confirms your domain control, a green success popup appears:

✅ "Thank you for proving the domain ownership for [your domain]. Domain Verification is completed successfully. Please track your order and complete your pending actions to speed up the certificate issuance process."

Click OK to dismiss the popup.

The Order Actions list now updates:

#	Action
1. Submit CSR	✅ Completed (green)
2. Subscriber Agreement	✅ Completed (green)
3. Domain Verification	✅ Completed (green)
4. Certificate Download	🟠 Issuance Pending (orange)

The Certificate Status in the right sidebar may still show "Pending for Approver" at this point - the internal Administrator approval in CERTInext must also be completed before the certificate is fully issued.

⚠️ Reminder about Administrator Approval: Even after domain verification is complete, the certificate will not be issued until the CERTInext account Administrator approves the order. If the Certificate Status stays on "Pending for Approver" for a long time after domain verification, contact your Administrator.

Certificate Issued - Step 4 Becomes Available

Once both domain verification is complete AND the Administrator has approved the order, emSign issues the Wildcard certificate. The Order Actions list updates:

#	Action
1. Submit CSR	✅ Completed (green)
2. Subscriber Agreement	✅ Completed (green)
3. Domain Verification	✅ Completed (green)
4. Certificate Download	✅ Certificate Issued (green)

The Order Details sidebar on the right updates to show:

• Order Status: Order Accepted (orange - note this is normal at this stage)

• Certificate Status: Certificate Generated (green) ← This is the key status showing the Wildcard certificate exists and is ready

Downloading the Certificate (Step 4 on the emSign Portal)

What you see: Expanding the "4. Certificate Download" row shows a green "Certificate Issued" badge and a download message.

The Download Message

The expanded section shows:

"Your certificate has been issued and ready for download. An email containing certificate download instructions has been sent to your email ID ([your email]). In case, if you have not received an email, please click Resend Email button to resend the email. Your certificate is based on the CSR submitted by you. Please ensure to import / use the certificate against the same key-pair, from where the CSR was generated. Please follow the necessary instructions in your download notification email to download your certificate."

⚠️ Important - Key Pair: Your Wildcard certificate was created from your CSR. It must be installed on your server together with the private key that was generated at the same time as the CSR. The certificate and private key are a matched pair and must both be present on the server for HTTPS to work. Never share or lose your private key.

Two Buttons

Button	What It Does
Resend Email	Resends the certificate download notification email to your registered email address. Use this if you did not receive the email.
Download Certificate	Directly downloads the certificate from this page (without needing the email link).

Email 2 - Certificate Ready: "Your Certificate is ready for download"

What you see: A second email arrives at your Requestor Email ID.

Email Subject: ORDER #[your order ID] - Your Certificate is ready for download

Email Content:

Field	Value
Greeting	Dear [Your Name], / Your Certificate is ready for download!
Order ID	Your unique order number
Ordered Date	Date and time in UTC
Product & Validity	DV SSL Certificate Wildcard
Identifier	Your wildcard domain name (e.g., *.mybusiness.com)

The email contains:

• An orange "Download Certificate" button - click it to go directly to the certificate download page

• OR - A URL you can copy and paste into your browser's address bar to reach the download page

📌 Save this email. The download link allows you to access the certificate directly. If you miss it, use the Resend Email button in the emSign Subscriber Portal, or download directly from CERTInext (Certificates → Orders → View → 3-dot menu → Download Certificate).

Certificate Download - Selecting Your Format

Clicking the "Download Certificate" button (from the email or the emSign portal) takes you to the emSign Subscriber Portal download page.

The Download Landing Page

Page message:

"Thanks for completing the necessary steps. Your certificate has been issued and ready for download. To continue further, please click 'Download Certificate'."

The page confirms:

• Order ID

• Product & Validity: DV SSL Certificate Wildcard

• Domain Name: Your wildcard domain (e.g., *.mybusiness.com)

Click the orange "Download Certificate" button on this page.

Choosing the Download Format

A popup appears titled "Select the Format to download" with four options:

Format	What It Is	Best For
DER encoded binary X.509 (.CER)	A binary (machine-readable) format. The file is not human-readable text.	Java applications, some enterprise systems, older Microsoft environments
Base-64 encoded X.509 (.CER)	A text-based format with a .CER file extension.	Windows systems, IIS web server
Base-64 encoded X.509 (.CRT)	A text-based format with a .CRT file extension - same content as .CER, just a different extension.	Apache, Nginx, Linux web servers - the most commonly used format
Zip	A compressed ZIP archive containing multiple certificate files (the certificate, intermediate chain, and optionally root certificate).	When you need all certificate files in one download - recommended if you are unsure which format to choose

📌 Which format should I choose?

- If you use Apache or Nginx (Linux): choose Base-64 encoded X.509 (.CRT)

- If you use Windows IIS or Microsoft environments: choose Base-64 encoded X.509 (.CER) or DER encoded binary

- If you use cPanel or Plesk shared hosting: choose Base-64 encoded X.509 (.CRT)

- If you are unsure: choose Zip - it contains everything and you can use whichever file you need

Select the format and click the Download button. The certificate file saves to your computer.

⚠️ Important: Your certificate file does NOT include your private key. Your private key was created on your server when you generated the CSR - it never left your server. The Wildcard certificate and the private key must both be present on your server to enable HTTPS. Never share your private key with anyone. If you install this Wildcard certificate on multiple servers, each server needs a copy of both the certificate AND the private key.

Downloading Directly from CERTInext

In addition to the emSign Subscriber Portal and email, you can also download your certificate directly from within CERTInext once it has been issued:

1. Log in to CERTInext.

2. Go to Certificates → Orders in the left sidebar.

3. Find your Wildcard certificate order in the list (Certificate Status shows "Certificate Generated" or green status).

4. Click View to open the order details.

5. Click the 3-dot menu (⋮) in the top-right corner.

6. Select "Download Certificate" from the menu.

📌 The 3-dot menu also shows "Reissue Certificate" - this allows you to reissue the Wildcard certificate (for example, if you need to provide a new CSR due to a key compromise) without purchasing a new certificate. The reissued certificate will have the same expiry date as the original. Contact your administrator before reissuing.

After Download - The Order is Complete

Back in CERTInext - Final Order Status

After you download the certificate, return to CERTInext and check Certificates → Orders. Click View on your order. The status has now fully updated:

Order Summary bar:

• Order Status: Order Fulfilled (green badge)

• Certificate Status: Certificate Downloaded (green badge)

SSL Subscription Information panel:

• Subscription Start Date: The date and time the certificate was issued

• Subscription End Date: Exactly 1 year later

• Subscription Status: Active (green)

Issuer CA Information:

• Root CA: emSign CA

• CA Type: Public

These details confirm your Wildcard certificate was successfully issued by emSign and is now active.

Installing the Wildcard Certificate on Your Server

After downloading, you need to install the certificate on your web server. The Wildcard certificate and its private key must both be on each server where you want to use it.

Apache / Nginx (Linux - most common):

1. Upload the .crt file and the intermediate/chain certificate file to your server.

2. Edit your server's SSL configuration file to point to these files and your private key file.

3. Restart Apache or Nginx.

4. Test by visiting your subdomains at https://subdomain.yourdomain.com - the padlock should appear on all subdomains.

Windows IIS:

1. Open IIS Manager.

2. Go to Server Certificates → Complete Certificate Request.

3. Select your downloaded certificate file.

4. Bind the certificate to your website on port 443.

5. Repeat the binding for each subdomain (host header) you wish to secure.

cPanel / Plesk (Shared Hosting):

1. Log in to your hosting control panel.

2. Go to SSL/TLS → Manage SSL Sites or Install Certificate.

3. Paste the Base-64 certificate contents into the Certificate field.

4. Also paste the CA Bundle / Intermediate Certificate contents.

5. Click Install or Save.

📌 Installing on Multiple Servers: One advantage of a Wildcard certificate is that you can install the same certificate on multiple servers - for example, your web server, mail server, and API server - all covering different subdomains. Each server installation requires a copy of both the certificate file and the matching private key.

📌 Ask for help if needed: Installing a certificate on a server requires server administration access. If you are not your organisation's IT administrator, hand the downloaded certificate file to your IT team and ask them to install it.

Summary - The Complete DV Wildcard Certificate Journey

Step	Where	Action	Result
1–6	CERTInext	Fill in application wizard & pay	Order submitted; Order Status: Order Accepted
Post-payment	CERTInext	View Order page	Certificate Status: Pending for Approver
Email 1	Your inbox	Receive "Order Successful" email	Contains "Track Order" button
Track Order Portal	emSign Subscriber Portal	See 4 Order Actions	Steps 1 & 2 already complete
Domain Verification	emSign Subscriber Portal	Click Verify → choose DNS TXT method → add TXT record → verify	Domain validated
Admin Approval	CERTInext	Administrator approves the order	Certificate Status moves to Certificate Generated
Email 2	Your inbox	Receive "Certificate Ready" email	Contains "Download Certificate" button
Download	emSign Portal or CERTInext (3-dot menu → Download Certificate)	Choose format (.CRT / .CER / Zip) → download	Wildcard certificate file saved to your computer
Install	Your web server(s)	Install certificate on all servers that need it	HTTPS padlock appears on all subdomains
CERTInext	Orders → View	Final check	Order Status: Order Fulfilled; Certificate Status: Certificate Downloaded; Subscription: Active

📌 InCommon Users - Final Note: The complete journey shown above applies equally to InCommon DV Wildcard SSL certificates. The key differences are: (1) pricing may be $0.00 or a flat institutional rate under your InCommon agreement, (2) validity is 30 days / 90 days / 199 days per certificate issuance as required by CA/Browser Forum rules, and (3) auto-renew will trigger annually. Contact your institution's IT/PKI administrator if the certificate shows unexpected costs, if the renewal process requires additional institutional approval steps, or if you need to install the certificate on university-managed servers.