SSL certificates

Overview

A custom SSL certificate is what lets your checkout run on your own domain instead of UltraCart's. You can buy one through UltraCart, or buy one anywhere else and import it.

The shared MERCHANTID.ultracartstore.com host is fine while you are setting up. Once you are taking production traffic, or putting buy links into email marketing, a certificate on your own domain is what puts your brand in the checkout URL, keeps your SEO value on your own domain, and gives you a domain reputation that no other merchant shares. See Domains & Hosting for the full picture.

Everything on this page happens on one screen: Main Menu → Configuration → Checkout → SSL Certificate (Custom).

Trial accounts see a prompt to add billing details first. Once your Service Plan has a credit card on file, the screen offers three options: Yes, sign me up!, No Thanks, and Configure 3rd Party SSL Certificate.

The custom SSL certificate costs $7.50 per month, which covers the dedicated IP allocation, plus the price of the certificate itself. UltraCart resells Sectigo certificates starting at $59 per year. Sectigo was called Comodo CA until 2018, so you may still see the Comodo name on older paperwork and in some of the screens below.

Buy a certificate through UltraCart

Choose Yes, sign me up! to reach the purchase form.

Complete the form with your Secure Server Name and your company name and address, then choose a certificate length. A 3 year certificate costs less per year and cuts down on renewal work.

Secure Server Name is the custom SSL address. A secure prefix (secure.mydomain.com) is the usual choice because it reads as secure to shoppers, but store.mydomain.com or checkout.mydomain.com work equally well.

You cannot use your main website address, www.mydomain.com, if your website is hosted outside UltraCart. A domain resolves to one place, and that one is already taken by your web host. See the FAQ below.

Enter your company details accurately. They are checked during validation, and a mismatch delays or rejects the order.

Choose the approver address in the Email dropdown. See Domain control validation below.

Order status

The screen reports where your order has reached.

Status	What it means	Roughly how long
Order Received	UltraCart has your order and will process it shortly	1 business day
Validation Documentation Required	Upload the requested documents with the upload validation documents button, which appears only at this step	Waiting on you
Validation Documents Pending Review	UltraCart has your validation documents and is reviewing them	1 to 2 business days
Requested	UltraCart has requested your certificate from Sectigo and is waiting for it to be issued	Waiting on Sectigo
Sent CSR to Merchant	You chose to buy the certificate elsewhere. UltraCart is waiting for you to obtain it and upload it	Waiting on you
Pending Installation by UltraCart	UltraCart has your third party certificate and will install it shortly	1 business day
Verify DNS	The certificate is installed, and UltraCart is waiting for your DNS to point the domain at UltraCart. The screen shows the CNAME to create if it is missing or wrong	Waiting on you
Issued	The certificate is configured and active

While a new certificate or a renewal waits on the validation email, the screen shows a Resend DCV button. If the email has not arrived, see If the validation email does not arrive.

Domain control validation

UltraCart sells the Sectigo EssentialSSL, a domain validated certificate. The only check is that you control the domain, which makes it the fastest to obtain and the easiest to renew.

warning

Set up one of the five approved mailboxes before you order. Validation email can only be sent to a constructed address at your own domain:

• admin@yourdomain.com
• administrator@yourdomain.com
• hostmaster@yourdomain.com
• postmaster@yourdomain.com
• webmaster@yourdomain.com

If none of these exists and can receive mail, the certificate cannot be issued. Create one, or add it as an alias to a mailbox you already read, before starting the purchase.

Addresses taken from your domain's WHOIS record are no longer accepted. CA/Browser Forum ballot SC-80v3 removed WHOIS from domain validation in two stages during 2025, and since 15 July 2025 no public certificate authority may rely on it. One practical upshot: domain privacy services no longer interfere with validation, because the WHOIS contact is not consulted at all.

Choose the approver address

The purchase form has an Email dropdown, set to none until you choose. It lists the five addresses at your domain. For secure.mydomain.com or www.mydomain.com, the addresses are at mydomain.com, for example admin@mydomain.com. Pick a mailbox you can read right now. The validation email goes only to the address you pick.

Renewals and re-keys need validation too

Sectigo does not reuse an earlier validation. Every new order, every renewal, and every re-key sends a new validation email, and it can only go to one of the five addresses above. If your last certificate was approved by an email to a WHOIS contact or another address, set up one of the five mailboxes before the renewal date. Without one, the renewal cannot be issued and the certificate expires.

The validation link and code are valid for 30 days.

If the validation email does not arrive

• Confirm the mailbox exists and accepts mail from outside your organization. Send a test message to it from an outside account such as Gmail.
• Check that the domain has working MX records. If the domain does not receive mail at all, none of the five addresses will work.
• Look in spam, junk, and quarantine folders. Some mail filters hold messages that contain approval links.
• An alias or forwarding rule that delivers to a mailbox you read is fine. A shared group that blocks external senders is not.
• When the mailbox is ready, go to Main Menu → Configuration → Checkout → SSL Certificate (Custom) and click Resend DCV. The button appears while a new certificate or renewal is waiting on validation.

Approve the certificate

The verification email contains a link and a validation code. Follow the link and enter the code to approve the certificate. EssentialSSL needs nothing more. Organization validated certificates, if you buy one elsewhere, also need business documents and a phone callback.

Use a certificate you bought elsewhere

Importing a third party certificate goes through a certificate signing request, or CSR, which UltraCart generates for you.

1. Click Download CSR and give the CSR to the certificate authority you are buying from.
2. If asked for a server type during purchase, choose Apache (Apache/Mod_ssl).
3. When the certificate is issued, click upload certificate and either choose the ZIP file from your computer or paste the certificate into the Certificates field, then click Upload.

warning

Include the entire block when copying a CSR or a certificate, header and footer lines included. They are part of the file and it will not validate without them. Include all intermediate root certificates too.

If the upload fails validation, you may need to request the CSR again and reissue the certificate from your certificate authority.

Renew with a third party, using GoDaddy as the example

1. Buy a credit for an SSL certificate with GoDaddy and start the purchase.

2. When GoDaddy asks for a CSR, generate one in UltraCart: on the SSL Certificate (Custom) screen, click Renew with 3rd Party and fill out the form.

   

3. View or download the CSR. Download CSR saves a file named after your secure host name with a .csr extension.

   

4. Upload the CSR into GoDaddy. Choose Apache (Apache/Mod-SSL) if asked for a server type.

5. GoDaddy issues the certificate as a ZIP named after your secure host name.

6. Back on the SSL Certificate (Custom) screen, click Upload Certificate.

   

7. Browse to the ZIP you saved and click upload.

   

Installation

Once a certificate reaches the installation stage, UltraCart installs it automatically Monday through Friday at 9 AM, 12 PM, and 3 PM Eastern.

Certificate actions

Each certificate on the screen carries these buttons.

Button	What it does
Renew with 3rd party	Generates a CSR so you can buy the renewal elsewhere
Do Not Renew	Tells UltraCart not to renew this certificate
Re-key	Reissues the certificate to obtain the newest one
Move	Moves the certificate to another UltraCart account
Download	Downloads the certificate
Delete	Removes the certificate from the account

Use the certificate on a checkout-only StoreFront

Once a certificate exists, you can assign it to a StoreFront running in checkout-only mode.

1. On the StoreFront's General tab, click Change StoreFront Location.

   

2. Select the domain from the dropdown in the second section of the dialog, then click Change StoreFront Domain.

   

Every buy link that pointed at the legacy checkout now points at the StoreFront.

Use secure.ultracart.com by default

The advanced settings carry a checkbox, Use secure.ultracart.com by default.

With it checked, buy links coded against secure.ultracart.com stay there. With it unchecked, such a link redirects to the first certificate issued on the account. If you use several certificates, assign the right one to each buy link.

Move a certificate to another account

Merchants with more than one UltraCart account can move a certificate between them. Click the move button next to the certificate, then sign in to the destination account.

Remove a certificate

If the certificate is currently used by a StoreFront, detach it first: open that StoreFront's menu, click Change Location, and pick one of the built-in hosts or another certificate from the dropdown.

Once nothing is using it, go to Main Menu → Configuration → Checkout → SSL Certificate (Custom) and click the delete button next to it.

warning

Once you remove a certificate it is gone. There is no undo and no backup.

Frequently asked questions

Why does my SSL URL go to the UltraCart login page?

That is the default unless a catalog is associated with the same host name as the certificate. Go to Main Menu → Catalog, click new host, and enter the same domain name as your certificate. Contact UltraCart support to have the catalog activated afterward. You typically do not need a catalog host unless you are hosting everything on UltraCart.

Can I use the same certificate on my website and on UltraCart?

No. A certificate is tied to one domain name, and a domain name resolves to one IP address. You need one certificate for www.mysite.com on your web server and another for secure.mysite.com on UltraCart.

Where do I configure the DNS for my certificate?

At whoever manages DNS for the domain, usually your registrar. See DNS at your registrar.

The certificate is live but I get a certificate mismatch error.

Your browser or your computer cached the old DNS answer. Flush the DNS cache, close every window of the browser, reopen it, and try again. On Windows, open a command prompt and run ipconfig /flushdns.

Can I have several custom certificates on one account?

Yes. One is the default, and each additional one is used by updating the buy link URL or mbuy form to that certificate's address.

My TrustLogo says "IdAuthority Credentials are not available for this site".

That happens when you are displaying a trust logo that only works with organization validated certificates. EssentialSSL is validated by domain control email alone. EssentialSSL does have its own site seal, configurable on the Conversion and Tracking tab of the Screen Branding Themes editor.

Cloudflare shows my CNAME as correct, but UltraCart says the DNS is wrong.

UltraCart does not support proxying through Cloudflare. Turn the proxy off and point the CNAME directly at UltraCart, using the values from your setup email.