Predictika · TLS/SSL certificate subscription quotes

An AI sales agent's TLS certificate quote, checked before it goes out

An AI sales agent prepares a subscription quote for DigiCert TLS/SSL certificates: a plan, OV or EV validation, single-domain, multi-domain or wildcard names, a validity period and a term. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the published plans and returns a verdict, every reason and the total it computed.

Scope: DigiCert Basic, Secure Site and Secure Site Pro TLS/SSL subscriptions, OV and EV validation, single-domain, multi-domain and wildcard certificates. See everything this validator covers

This validator models DigiCert TLS/SSL certificate subscription quotes, not just the scenarios shown below.

  • Plans and validation — Basic, Secure Site and Secure Site Pro, each with OV or EV validation; organization validation for OV and EV, and the extra legal-existence checks that EV adds.
  • Names — single-domain, multi-domain and wildcard certificates: the number of names each type allows, wildcard names on OV certificates only, and up to 250 domains, subdomains and wildcards per subscription.
  • Validity and term — public certificates valid for at most 199 days, a subscription term of at least one year, and multi-year terms that go to a person.
  • Prerequisites and total — domain control validation completed before issuance, and the stated total against the total computed from the modeled prices.

Any DigiCert TLS certificate quote that touches these rules is in scope — not only the scenarios pictured here. Not covered: other DigiCert products (code signing, document signing, S/MIME, private PKI), negotiated and volume pricing, and taxes. The validator shows a computed total but no line-item table.

The AI sales agentBuilds the certificate subscription quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

6 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Rules that depend on the certificate typeOnly with care
Single, multi-domain and wildcard certificates each allow a different number of names and different wildcard use, so each type needs its own quantity and compatibility rules.		The type and the counts of domain and wildcard names are fields of one request and are checked together on every call.
Wildcard names that exist on OV onlyOnly with care
A rule has to compare the wildcard count with the validation level on every certificate type, and it is easy to miss the multi-domain case.		The validation level and the wildcard count are in one request and compared on every call.
Prerequisites before a certificate is issuedOnly with care
Domain control, organization validation and the extra EV checks are separate conditions that depend on the validation level, so each needs its own rule.		Every prerequisite is a field of the request and is checked on every call.
A stated total that must match the computed priceOnly with workarounds
The price is built from a base price, a price per added name and a wildcard surcharge, so a separate rule is needed to recompute it and compare it with the stated figure.		The stated total is a field of the request and is compared with the computed total on every call.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1EV validation includes extra legal-existence checks beyond OV; they are not complete.
2Wildcard names are offered on OV certificates only, not on EV.
3A wildcard certificate covers exactly one wildcard name; use a multi-domain certificate to mix wildcard and other names.
4A single-domain certificate covers one name; the quote lists 2. Use a multi-domain certificate.
5A single-domain certificate cannot carry a wildcard name; choose the wildcard certificate type.
6A multi-domain certificate needs at least two names; the quote lists 1.
7250 names on one subscription; a person should confirm the volume terms.
8The quote has 251 domain names; one subscription covers up to 250 domains, subdomains and wildcards.
9251 names on one subscription; a person should confirm the volume terms.
10101 names on one subscription; a person should confirm the volume terms.
11The quote asks for a certificate valid 397 days; public TLS certificates are now issued for at most 199 days.
12Domain control validation has not been completed; it is required before issuance.
13OV and EV certificates need the organization validated; it has not been.
14A 2 year term; public pages show 12 month subscriptions, so a person should confirm multi-year terms.
15The quote states a total of 600 dollars; the modeled price is 624 dollars.
16The quote lists 0 domain names; at least one is needed.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Wildcards, validity and prerequisites: A Secure Site EV multi-domain subscription for 30 domain names and 2 wildcard names

    
The agent's request. Please quote a DigiCert Secure Site EV multi-domain subscription covering 30 domain names and 2 wildcard names, valid for 397 days, on a 1-year term. The total is 16,260 dollars. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Wildcard on EV. Wildcard names are offered on OV certificates only, not on EV.
    • 
      
  • Validity over 199 days. The quote asks for a certificate valid 397 days; public TLS certificates are now issued for at most 199 days.
    • 
      
  • Domain control not validated. Domain control validation has not been completed; it is required before issuance.
    • 
      
  • EV checks missing. EV validation includes extra legal-existence checks beyond OV; they are not complete.
    • 
      
  • Stated total does not match. The quote states a total of 16,260 dollars; the modeled price is 18,260 dollars.
    • 
    

    
2. Wildcards, validity and prerequisites: The agent resubmits after fixing the errors

    
The agent's request. Please quote a DigiCert Secure Site EV multi-domain subscription covering 32 domain names, valid for 199 days, on a 1-year term. The total is 16,260 dollars. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Price summary. 32 name(s); annual subscription 16,260 dollars, 16,260 dollars over 1 year(s) at the modeled prices.
    • 
    

    
3. Certificate type and validation: A Secure Site subscription for 3 domain names and a wildcard name

    
The agent's request. Please quote a DigiCert Secure Site OV single-domain subscription covering 3 domain names and 1 wildcard name, valid for 199 days, on a 1-year term. The total is 624 dollars. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Single-domain with several names. A single-domain certificate covers one name; the quote lists 4. Use a multi-domain certificate.
    • 
      
  • Wildcard name on a single-domain certificate. A single-domain certificate cannot carry a wildcard name; choose the wildcard certificate type.
    • 
      
  • Organization not validated. OV and EV certificates need the organization validated; it has not been.
    • 
    

    
4. Certificate type and validation: The agent resubmits after fixing the errors

    
The agent's request. Please quote a DigiCert Secure Site OV multi-domain subscription covering 3 domain names and 1 wildcard name, valid for 199 days, on a 1-year term. The total is 2,224 dollars. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Price summary. 4 name(s); annual subscription 2,224 dollars, 2,224 dollars over 1 year(s) at the modeled prices.
    • 
    

    
5. Volume, validity and total: A 260-name Basic multi-domain subscription on a two-year term

    
The agent's request. Please quote a DigiCert Basic OV multi-domain subscription covering 260 domain names, valid for 365 days, on a 2-year term. The total is 30,000 dollars. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • More than 250 names. The quote has 260 domain names; one subscription covers up to 250 domains, subdomains and wildcards.
    • 
      
  • Validity over 199 days. The quote asks for a certificate valid 365 days; public TLS certificates are now issued for at most 199 days.
    • 
      
  • Stated total does not match. The quote states a total of 30,000 dollars; the modeled price is 62,904 dollars.
    • 
      
  • Large order over 100 names. 260 names on one subscription; a person should confirm the volume terms.
    • 
      
  • Multi-year term. A 2 year term; public pages show 12 month subscriptions, so a person should confirm multi-year terms.
    • 
    

    
6. Volume, validity and total: The agent resubmits after fixing the errors

    
The agent's request. Please quote a DigiCert Basic OV multi-domain subscription covering 90 domain names, valid for 199 days, on a 1-year term. The total is 11,052 dollars. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Price summary. 90 name(s); annual subscription 11,052 dollars, 11,052 dollars over 1 year(s) at the modeled prices.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares a subscription quote for DigiCert TLS/SSL certificates: a plan, OV or EV validation, single-domain, and more. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the published plans and returns a verdict, every reason and the total it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote a DigiCert Secure Site EV multi-domain subscription covering 30 domain names and 2 wildcard names, valid for 397 days, on a 1-year term. The total is 16,260 dollars. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. Wildcard names are offered on OV certificates only, not on EV. The quote asks for a certificate valid 397 days; public TLS certificates are now issued for at most 199 days. Domain control validation has not been completed; it is required before issuance. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other and against the stated total.
    7. 
      
  7. What this shows: for a stated total that must match the computed price, a rules-based CPQ can do this only with workarounds.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the domain names to 32, the wildcard names to 0, the validity to 199 days, the domain control validated to yes and the EV checks completed to yes.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All five earlier findings are cleared.
    13. 
      
  13. Five problems caught in one call, fixed in one pass, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    14.