Certificates Glossary · Hosting & Cloud

24-hour and 5-day revocation deadlines: the BR deadlines for revoking a certificate: 24 hours for a subscriber request, key compromise or unreliable validation, 5 days for misuse, changed information or non-compliant issuance (Shorter Lifetimes, Revocation & Distrust).
Account and method pinning (CAA): the RFC 8657 CAA parameters accounturi, which limits issuance to one ACME account, and validationmethods, which limits the validation methods allowed (The Web PKI & Certificate Transparency).
ACME: the protocol a client uses to get certificates from a CA automatically: a directory, an account, an order with authorizations and challenges, then finalize and download (ACME & Certificates at Hosting Scale).
ACME Renewal Information (ARI): RFC 9773's mechanism that moves the decision of when to renew from the client to the CA, which returns a suggested renewal window per certificate (ACME & Certificates at Hosting Scale).
Agreed-Upon Change to Website: the BR validation methods that check a file on the website, under /.well-known/pki-validation or through ACME's http-01 (The Web PKI & Certificate Transparency).
Amazon Trust Services: the CA behind AWS Certificate Manager, issuing free DV certificates for use on AWS services (The Web PKI & Certificate Transparency).
AWS Certificate Manager (ACM): AWS's managed certificates from Amazon Trust Services, validated by DNS (with automatic renewal), email or HTTP through CloudFront, usable on AWS services (ACME & Certificates at Hosting Scale).
Baseline Requirements (BRs): the CA/Browser Forum's shared floor of rules for publicly trusted TLS certificates, covering validation, lifetimes and revocation (The Web PKI & Certificate Transparency).
CA distrust: a root program ceasing to trust a CA's roots, usually from a cutoff date keyed on the earliest SCT, so existing certificates keep working until expiry and renewals become the emergency (Shorter Lifetimes, Revocation & Distrust).
ca_distrust_events: the table with one row per root program distrust decision (roots covered, basis, cutoff, effective date, source), with successor rows when a date moves (Shorter Lifetimes, Revocation & Distrust).
CA/Browser Forum: the body in which issuers and browsers vote together on the TLS Baseline Requirements (The Web PKI & Certificate Transparency).
CAA: a DNS record naming the CAs allowed to issue for a domain, with issue, issuewild and iodef tags, found by climbing from the requested name to each parent (The Web PKI & Certificate Transparency).
Caddy: web server software many platforms embed, which obtains certificates over ACME from Let's Encrypt with ZeroSSL as fallback, including on demand at the first handshake (ACME & Certificates at Hosting Scale).
Certificate Transparency (CT): public, append-only, untrusted logs of every publicly trusted certificate, which don't stop misissuance but make it impossible to hide (The Web PKI & Certificate Transparency).
Certificates per registered domain: the Let's Encrypt rate limit that counts every name under one registered domain together, so a platform giving customers subdomains of its own domain shares one allowance (ACME & Certificates at Hosting Scale).
Challenge (ACME): a way to satisfy an authorization, with a token and a status; the client publishes the response and tells the CA to check (ACME & Certificates at Hosting Scale).
Cloud-managed DV: certificates a cloud or CDN issues and renews for its own services (ACM, a CDN's certificates), with no renewal work but usable only there (The Web PKI & Certificate Transparency).
Consecutive authorization failures: the Let's Encrypt rate limit that pauses an identifier after repeated failed validations, punishing hosts that retry for domains pointed elsewhere (ACME & Certificates at Hosting Scale).
CRLite: Firefox's compact, frequently refreshed encoding of every revoked certificate, downloaded by the browser instead of fetching CRLs per connection (Shorter Lifetimes, Revocation & Distrust).
CRLs: lists of revoked serials a CA publishes for clients to download, and the only revocation data Let's Encrypt still publishes (Shorter Lifetimes, Revocation & Distrust).
CRLSets: Chrome's browser-pushed set of revocations, covering a small share of all revocations (Shorter Lifetimes, Revocation & Distrust).
DigiCert: a commercial CA selling DV, OV and EV certificates, with ACME through EAB credentials created per certificate type (The Web PKI & Certificate Transparency).
Directory (ACME): the single ACME URL that lists the others (newNonce, newAccount, newOrder, revokeCert, keyChange) and a meta object, including whether external account binding is required (ACME & Certificates at Hosting Scale).
DNS Change: the BR validation method in which the CA checks a random value in a CNAME, TXT or CAA record, the basis of ACME's dns-01 (The Web PKI & Certificate Transparency).
DNS Labeled with Account ID: the BR validation method for ACME's draft dns-account-01 challenge, which can cover wildcards (The Web PKI & Certificate Transparency).
DNS TXT Record with Persistent Value: the BR validation method of a standing TXT record at _validation-persist.<name> naming the CA and an account (The Web PKI & Certificate Transparency).
dns-01: the ACME challenge answered with a TXT record at _acme-challenge.<name> holding a hash of the key authorization; the only challenge that covers wildcards (ACME & Certificates at Hosting Scale).
dns-persist-01: an ACME challenge using a standing TXT record at _validation-persist.<name> that names the CA and the ACME account, so validation needn't be repeated per order (ACME & Certificates at Hosting Scale).
DV from a free ACME CA: domain-validated certificates issued automatically for free, supported by every host, where one CA's outage or distrust hits every site on it (The Web PKI & Certificate Transparency).
Earliest SCT: the timestamp Chrome keyed its Entrust distrust on, which the certificate carries and which a host can check only if it stored its certificates' SCTs (Shorter Lifetimes, Revocation & Distrust).
External Account Binding (EAB): a key identifier and MAC key issued out of band that bind a new ACME account to a customer account the CA already has, required by commercial CAs and some free ones (ACME & Certificates at Hosting Scale).
Finalize and download: the ACME step in which, once every authorization is valid, the client submits a CSR naming exactly the order's identifiers and downloads the certificate (ACME & Certificates at Hosting Scale).
Google Trust Services: Google's CA, issuing free DV certificates through Google Cloud's Public CA over ACME with External Account Binding (The Web PKI & Certificate Transparency).
http-01: the ACME challenge answered by serving a file at /.well-known/acme-challenge/<token> over HTTP, which validates exactly the requested name and can't cover a wildcard (ACME & Certificates at Hosting Scale).
Key authorization: the string token || '.' || base64url(Thumbprint(accountKey)) that token-based ACME challenges build their response from, binding the proof to the account (ACME & Certificates at Hosting Scale).
Let's Encrypt: ISRG's nonprofit CA issuing free DV certificates over ACME with no external account, the default CA almost everywhere (The Web PKI & Certificate Transparency).
Maximum Merge Delay: the time within which a CT log promises, through an SCT, to include a submitted entry in its tree (The Web PKI & Certificate Transparency).
Merkle tree (CT log): the structure of a CT log, whose signed tree head commits to its size and root hash, with inclusion and consistency proofs showing entries are present and the log only appends (The Web PKI & Certificate Transparency).
Monitors and auditors: CT participants that read every new log entry to watch for certificates on names they care about, and check that logs behave honestly (The Web PKI & Certificate Transparency).
Multi-perspective issuance corroboration: the BR rule that a CA repeat each validation and CAA check from several remote network perspectives and issue only if enough agree, against BGP hijacks (The Web PKI & Certificate Transparency).
OCSP: the protocol in which a client asks the CA about one certificate's status, which leaks browsing to the CA and soft-fails when unreachable, and which Let's Encrypt has turned off (Shorter Lifetimes, Revocation & Distrust).
OCSP stapling and Must-Staple: the server attaching a CA-signed OCSP response to the handshake, made mandatory by Must-Staple, which removes the privacy leak but has no place in defaults for CRL-only CAs (Shorter Lifetimes, Revocation & Distrust).
On-demand issuance: obtaining a certificate at a TLS terminator during the first handshake for a name, which must be gated or it orders for any name a client sends (ACME & Certificates at Hosting Scale).
Order (ACME): the ACME object created with newOrder for a list of identifiers, carrying status, expiry, authorizations and the finalize URL (ACME & Certificates at Hosting Scale).
OV and EV: certificates that add vetted organization identity to domain control, putting identity in the certificate for those who check it, at the cost of manual vetting (The Web PKI & Certificate Transparency).
Per-customer SAN bundle: one certificate covering all of a customer's names, convenient for panel accounts but one failing name blocks the renewal of all (ACME & Certificates at Hosting Scale).
Precertificate: a certificate a CA logs before issuance, carrying a poison extension so no client accepts it, so the SCTs can be embedded in the real certificate (The Web PKI & Certificate Transparency).
Preflight (ACME): checking from outside that a name points at the provider and that CAA allows its CA before creating an ACME order, so customer misconfiguration costs no failure budget (ACME & Certificates at Hosting Scale).
Private CA: an organization's own root, trusted only by its devices, allowing any lifetime or internal name but not trusted by browsers (The Web PKI & Certificate Transparency).
replaces: the ACME order field naming the certificate a new order succeeds, which the CA checks belongs to the same account (ACME & Certificates at Hosting Scale).
Root program: a trust store with a policy attached, such as the Chrome Root Program, which enforces its rules by removing CAs (The Web PKI & Certificate Transparency).
SC-081: the CA/Browser Forum ballot that set the schedule shortening certificate lifetimes and validation reuse periods in steps toward 47 days (Shorter Lifetimes, Revocation & Distrust).
Sectigo: a commercial CA selling DV, OV and EV certificates under commercial accounts (The Web PKI & Certificate Transparency).
Short-lived certificates: certificates that expire within days, replacing revocation because there is nothing to check (Shorter Lifetimes, Revocation & Distrust).
Signed Certificate Timestamp (SCT): a CT log's immediate signed promise, with its log ID and a timestamp, to include a submitted certificate within its Maximum Merge Delay (The Web PKI & Certificate Transparency).
Signed Tree Head: a CT log's periodic signature over its tree's size and root hash (The Web PKI & Certificate Transparency).
Temporally sharded logs: CT logs that each accept only certificates expiring within a range of at most a year, so a log can be retired once everything in it has expired (The Web PKI & Certificate Transparency).
TLS Using ALPN: the BR validation method behind ACME's tls-alpn-01 (The Web PKI & Certificate Transparency).
tls-alpn-01: the ACME challenge answered in a TLS handshake on port 443 using a dedicated ALPN protocol (RFC 8737), suited to TLS-terminating proxies (ACME & Certificates at Hosting Scale).
unknown_sct: the classification for a certificate whose SCTs were never parsed, which can't be judged against an SCT-keyed distrust rule and is treated as a finding (Shorter Lifetimes, Revocation & Distrust).
Validation reuse period: how long a completed domain validation can back later certificates, shrinking in steps with certificate lifetimes (The Web PKI & Certificate Transparency).
Wildcard certificate: a certificate covering one level of subdomains, which needs a DNS validation method and so ties wildcards to running the customer's DNS (ACME & Certificates at Hosting Scale).
ZeroSSL: a CA issuing free DV certificates over ACME with EAB credentials and paid certificates through its API (The Web PKI & Certificate Transparency).

24-hour and 5-day revocation deadlines: the BR deadlines for revoking a certificate: 24 hours for a subscriber request, key compromise or unreliable validation, 5 days for misuse, changed information or non-compliant issuance (Shorter Lifetimes, Revocation & Distrust).
Account and method pinning (CAA): the RFC 8657 CAA parameters accounturi, which limits issuance to one ACME account, and validationmethods, which limits the validation methods allowed (The Web PKI & Certificate Transparency).
ACME: the protocol a client uses to get certificates from a CA automatically: a directory, an account, an order with authorizations and challenges, then finalize and download (ACME & Certificates at Hosting Scale).
ACME Renewal Information (ARI): RFC 9773's mechanism that moves the decision of when to renew from the client to the CA, which returns a suggested renewal window per certificate (ACME & Certificates at Hosting Scale).
Agreed-Upon Change to Website: the BR validation methods that check a file on the website, under /.well-known/pki-validation or through ACME's http-01 (The Web PKI & Certificate Transparency).
Amazon Trust Services: the CA behind AWS Certificate Manager, issuing free DV certificates for use on AWS services (The Web PKI & Certificate Transparency).
AWS Certificate Manager (ACM): AWS's managed certificates from Amazon Trust Services, validated by DNS (with automatic renewal), email or HTTP through CloudFront, usable on AWS services (ACME & Certificates at Hosting Scale).
Baseline Requirements (BRs): the CA/Browser Forum's shared floor of rules for publicly trusted TLS certificates, covering validation, lifetimes and revocation (The Web PKI & Certificate Transparency).
CA distrust: a root program ceasing to trust a CA's roots, usually from a cutoff date keyed on the earliest SCT, so existing certificates keep working until expiry and renewals become the emergency (Shorter Lifetimes, Revocation & Distrust).
ca_distrust_events: the table with one row per root program distrust decision (roots covered, basis, cutoff, effective date, source), with successor rows when a date moves (Shorter Lifetimes, Revocation & Distrust).
CA/Browser Forum: the body in which issuers and browsers vote together on the TLS Baseline Requirements (The Web PKI & Certificate Transparency).
CAA: a DNS record naming the CAs allowed to issue for a domain, with issue, issuewild and iodef tags, found by climbing from the requested name to each parent (The Web PKI & Certificate Transparency).
Caddy: web server software many platforms embed, which obtains certificates over ACME from Let's Encrypt with ZeroSSL as fallback, including on demand at the first handshake (ACME & Certificates at Hosting Scale).
Certificate Transparency (CT): public, append-only, untrusted logs of every publicly trusted certificate, which don't stop misissuance but make it impossible to hide (The Web PKI & Certificate Transparency).
Certificates per registered domain: the Let's Encrypt rate limit that counts every name under one registered domain together, so a platform giving customers subdomains of its own domain shares one allowance (ACME & Certificates at Hosting Scale).
Challenge (ACME): a way to satisfy an authorization, with a token and a status; the client publishes the response and tells the CA to check (ACME & Certificates at Hosting Scale).
Cloud-managed DV: certificates a cloud or CDN issues and renews for its own services (ACM, a CDN's certificates), with no renewal work but usable only there (The Web PKI & Certificate Transparency).
Consecutive authorization failures: the Let's Encrypt rate limit that pauses an identifier after repeated failed validations, punishing hosts that retry for domains pointed elsewhere (ACME & Certificates at Hosting Scale).
CRLite: Firefox's compact, frequently refreshed encoding of every revoked certificate, downloaded by the browser instead of fetching CRLs per connection (Shorter Lifetimes, Revocation & Distrust).
CRLs: lists of revoked serials a CA publishes for clients to download, and the only revocation data Let's Encrypt still publishes (Shorter Lifetimes, Revocation & Distrust).
CRLSets: Chrome's browser-pushed set of revocations, covering a small share of all revocations (Shorter Lifetimes, Revocation & Distrust).
DigiCert: a commercial CA selling DV, OV and EV certificates, with ACME through EAB credentials created per certificate type (The Web PKI & Certificate Transparency).
Directory (ACME): the single ACME URL that lists the others (newNonce, newAccount, newOrder, revokeCert, keyChange) and a meta object, including whether external account binding is required (ACME & Certificates at Hosting Scale).
DNS Change: the BR validation method in which the CA checks a random value in a CNAME, TXT or CAA record, the basis of ACME's dns-01 (The Web PKI & Certificate Transparency).
DNS Labeled with Account ID: the BR validation method for ACME's draft dns-account-01 challenge, which can cover wildcards (The Web PKI & Certificate Transparency).
DNS TXT Record with Persistent Value: the BR validation method of a standing TXT record at _validation-persist.<name> naming the CA and an account (The Web PKI & Certificate Transparency).
dns-01: the ACME challenge answered with a TXT record at _acme-challenge.<name> holding a hash of the key authorization; the only challenge that covers wildcards (ACME & Certificates at Hosting Scale).
dns-persist-01: an ACME challenge using a standing TXT record at _validation-persist.<name> that names the CA and the ACME account, so validation needn't be repeated per order (ACME & Certificates at Hosting Scale).
DV from a free ACME CA: domain-validated certificates issued automatically for free, supported by every host, where one CA's outage or distrust hits every site on it (The Web PKI & Certificate Transparency).
Earliest SCT: the timestamp Chrome keyed its Entrust distrust on, which the certificate carries and which a host can check only if it stored its certificates' SCTs (Shorter Lifetimes, Revocation & Distrust).
External Account Binding (EAB): a key identifier and MAC key issued out of band that bind a new ACME account to a customer account the CA already has, required by commercial CAs and some free ones (ACME & Certificates at Hosting Scale).
Finalize and download: the ACME step in which, once every authorization is valid, the client submits a CSR naming exactly the order's identifiers and downloads the certificate (ACME & Certificates at Hosting Scale).
Google Trust Services: Google's CA, issuing free DV certificates through Google Cloud's Public CA over ACME with External Account Binding (The Web PKI & Certificate Transparency).
http-01: the ACME challenge answered by serving a file at /.well-known/acme-challenge/<token> over HTTP, which validates exactly the requested name and can't cover a wildcard (ACME & Certificates at Hosting Scale).
Key authorization: the string token || '.' || base64url(Thumbprint(accountKey)) that token-based ACME challenges build their response from, binding the proof to the account (ACME & Certificates at Hosting Scale).
Let's Encrypt: ISRG's nonprofit CA issuing free DV certificates over ACME with no external account, the default CA almost everywhere (The Web PKI & Certificate Transparency).
Maximum Merge Delay: the time within which a CT log promises, through an SCT, to include a submitted entry in its tree (The Web PKI & Certificate Transparency).
Merkle tree (CT log): the structure of a CT log, whose signed tree head commits to its size and root hash, with inclusion and consistency proofs showing entries are present and the log only appends (The Web PKI & Certificate Transparency).
Monitors and auditors: CT participants that read every new log entry to watch for certificates on names they care about, and check that logs behave honestly (The Web PKI & Certificate Transparency).
Multi-perspective issuance corroboration: the BR rule that a CA repeat each validation and CAA check from several remote network perspectives and issue only if enough agree, against BGP hijacks (The Web PKI & Certificate Transparency).
OCSP: the protocol in which a client asks the CA about one certificate's status, which leaks browsing to the CA and soft-fails when unreachable, and which Let's Encrypt has turned off (Shorter Lifetimes, Revocation & Distrust).
OCSP stapling and Must-Staple: the server attaching a CA-signed OCSP response to the handshake, made mandatory by Must-Staple, which removes the privacy leak but has no place in defaults for CRL-only CAs (Shorter Lifetimes, Revocation & Distrust).
On-demand issuance: obtaining a certificate at a TLS terminator during the first handshake for a name, which must be gated or it orders for any name a client sends (ACME & Certificates at Hosting Scale).
Order (ACME): the ACME object created with newOrder for a list of identifiers, carrying status, expiry, authorizations and the finalize URL (ACME & Certificates at Hosting Scale).
OV and EV: certificates that add vetted organization identity to domain control, putting identity in the certificate for those who check it, at the cost of manual vetting (The Web PKI & Certificate Transparency).
Per-customer SAN bundle: one certificate covering all of a customer's names, convenient for panel accounts but one failing name blocks the renewal of all (ACME & Certificates at Hosting Scale).
Precertificate: a certificate a CA logs before issuance, carrying a poison extension so no client accepts it, so the SCTs can be embedded in the real certificate (The Web PKI & Certificate Transparency).
Preflight (ACME): checking from outside that a name points at the provider and that CAA allows its CA before creating an ACME order, so customer misconfiguration costs no failure budget (ACME & Certificates at Hosting Scale).
Private CA: an organization's own root, trusted only by its devices, allowing any lifetime or internal name but not trusted by browsers (The Web PKI & Certificate Transparency).
replaces: the ACME order field naming the certificate a new order succeeds, which the CA checks belongs to the same account (ACME & Certificates at Hosting Scale).
Root program: a trust store with a policy attached, such as the Chrome Root Program, which enforces its rules by removing CAs (The Web PKI & Certificate Transparency).
SC-081: the CA/Browser Forum ballot that set the schedule shortening certificate lifetimes and validation reuse periods in steps toward 47 days (Shorter Lifetimes, Revocation & Distrust).
Sectigo: a commercial CA selling DV, OV and EV certificates under commercial accounts (The Web PKI & Certificate Transparency).
Short-lived certificates: certificates that expire within days, replacing revocation because there is nothing to check (Shorter Lifetimes, Revocation & Distrust).
Signed Certificate Timestamp (SCT): a CT log's immediate signed promise, with its log ID and a timestamp, to include a submitted certificate within its Maximum Merge Delay (The Web PKI & Certificate Transparency).
Signed Tree Head: a CT log's periodic signature over its tree's size and root hash (The Web PKI & Certificate Transparency).
Temporally sharded logs: CT logs that each accept only certificates expiring within a range of at most a year, so a log can be retired once everything in it has expired (The Web PKI & Certificate Transparency).
TLS Using ALPN: the BR validation method behind ACME's tls-alpn-01 (The Web PKI & Certificate Transparency).
tls-alpn-01: the ACME challenge answered in a TLS handshake on port 443 using a dedicated ALPN protocol (RFC 8737), suited to TLS-terminating proxies (ACME & Certificates at Hosting Scale).
unknown_sct: the classification for a certificate whose SCTs were never parsed, which can't be judged against an SCT-keyed distrust rule and is treated as a finding (Shorter Lifetimes, Revocation & Distrust).
Validation reuse period: how long a completed domain validation can back later certificates, shrinking in steps with certificate lifetimes (The Web PKI & Certificate Transparency).
Wildcard certificate: a certificate covering one level of subdomains, which needs a DNS validation method and so ties wildcards to running the customer's DNS (ACME & Certificates at Hosting Scale).
ZeroSSL: a CA issuing free DV certificates over ACME with EAB credentials and paid certificates through its API (The Web PKI & Certificate Transparency).