Adobe-managed certificate program
The Adobe-managed certificate program is the recommended process for setting up first-party certificates needed for a CNAME implementation. The program is fully automated once configured. It renews certificates in a timely manner so that there is no impact to data collection due to expired certificates. The program is free for your first 100 CNAMEs.
The Adobe-managed certificate program doesn’t support routing data collection through a content delivery network (CDN). If you use a CDN, see Route data collection through a CDN. Organizations that need to manage their own certificates can use customer-managed certificates instead. If you currently manage your own certificates and want to move to the Adobe-managed certificate program, contact Adobe Customer Care.
Implementation
To implement a new certificate for first-party data collection, follow these steps:
- Download and fill out the First-party domain request form
- Open a ticket with Adobe Customer Care requesting to set up first-party data collection on the Adobe-managed certificate program. If your organization has data residency or compliance requirements, specify your desired RDC type in your request.
- Upon receiving the ticket, the Adobe representative provides you with a CNAME record. This record must be configured on your company’s DNS server before Adobe can purchase the certificate on your behalf. For example, the hostname
data.example.compoints tohiodsibxvip01.data.adobedc.net. If your organization uses DNS Certificate Authority Authorization (CAA) records, make sure that your CAA records allow DigiCert to issue certificates. See Maintenance and renewals. - When the CNAME record is in place on your organization’s servers, Adobe works with DigiCert to purchase and install a certificate on Adobe data collection servers.
- If you need an update to your
robots.txtfile when hosted by Adobe CNAME for first-party purposes, reach out to Customer Care with a request. Such a request is relevant when you want to update therobots.txtfile to prevent Google from crawling your subdomains.
Validate hostname forwarding
Once Adobe has installed the certificate, you can use one of the following methods to validate that it is working.
You can use any browser to validate that a certificate is installed correctly. Type your CNAME with _check as the path into the address bar. For example:
data.example.com/_check
If everything works, the browser shows SUCCESS. If the certificate is not installed correctly, you are issued a security warning.
curl)Most modern operating systems already have curl installed.
Type the following into the command line:
| code language-sh |
|---|
|
If everything works correctly, the console returns SUCCESS.
| note tip |
|---|
| TIP |
You can use the -k flag to disable the security warning to help with troubleshooting. |
nslookup)Type the following into the command line:
| code language-sh |
|---|
|
If everything works correctly, Adobe’s data collection servers are returned:
| code language-text |
|---|
|
Update implementation code
To use your new CNAME hostname, update your Adobe implementation once you have validated that your certificate works correctly. See Update your implementation.
Maintenance and renewals renewals
Adobe renews your certificate automatically. Thirty days before your certificate expires, Adobe validates that the CNAME is still valid and in use, and then renews the certificate on your behalf. To keep renewals working, avoid the following DNS changes:
- Removing or repointing your CNAME record: If the CNAME record is removed or no longer points to the Adobe secure hostname, Adobe can’t renew the certificate. This condition includes pointing the CNAME record to a content delivery network (CDN). If you plan to use a CDN, see Move an existing first-party implementation to a CDN before you change your DNS records.
- Adding CAA records that don’t authorize DigiCert: Certificate authorities check Certificate Authority Authorization (CAA) records on your hostname and its parent domains. If you use CAA records, include
digicert.comas an authorized issuer. For example,example.com. IN CAA 0 issue "digicert.com". - Restricting DigiCert issuance to a specific account: DigiCert’s domain locking feature adds an
account=parameter to a CAA record, such asexample.com. IN CAA 0 issue "digicert.com; account=<token>". This parameter restricts issuance to your organization’s DigiCert account, even ifdigicert.comis authorized, which prevents Adobe from obtaining a certificate. If your organization requires DigiCert domain locking, use customer-managed certificates instead. Domain locks set at your domain registrar, sometimes called transfer locks, are unrelated and don’t affect Adobe-managed certificates.
Frequently asked questions
Adobe offers two cipher security levels to meet varying customer needs for security on first-party data collection. These levels determine which encryption algorithms are supported for HTTPS connections with Adobe servers. Adobe regularly reviews and updates the set of supported algorithms based on current security practices. To change your cipher security settings, contact Customer Care.
- Standard requires TLS 1.2 or newer and at least 128-bit encryption. It is designed to provide the widest device compatibility while maintaining secure encryption.
- High requires TLS 1.2 or newer and removes support for weaker ciphers. It is designed for customers who want the strongest encryption. Clients released before 2015 typically can’t connect when cipher security is set to High.