November 2, 2020
DigiCert replacing multiple intermediate CA certificates
On November 2, 2020, DigiCert is replacing another set of intermediate CA certificates (ICAs). For a list of the ICA certificates being replaced, see our DigiCert ICA Update KB article.
How does this affect me?
Rolling out new ICAs does not affect existing certificates. We don't remove an old ICA from certificate stores until all the certificates issued from it have expired. This means active certificates issued from the replaced ICA will continue to be trusted.
However, it will affect existing certificates if you reissue them as they will be issued from the new ICA. We advise you to always include the provided ICA with every certificate you install. This has always been the recommended best practice to ensure ICA replacements go unnoticed.
No action is required unless you do any of the following:
- Pin the old versions of the intermediate CA certificates
- Hard code the acceptance of the old versions of the intermediate CA certificates
- Operate a trust store that includes the old versions of the intermediate CA certificates
If you do any of the above, we recommend updating your environment as soon as possible. Stop pinning and hard coding ICAs or make the necessary changes to ensure certificates issued from the new ICAs are trusted (in other words, can chain up to their updated ICA and trusted root).
Intermediate CA certificate replacements
Make sure to monitor the pages listed below. These are active pages and are updated regularly with ICA certificate replacement information and copies of the new DigiCert intermediate CA certificates.
Why is DigiCert replacing intermediate CA certificates?
We are replacing ICAs to:
- Promote customer agility with ICA replacement
- Reduce the scope of certificate issuance from any given ICA to mitigate the impact of changes in industry standards and CA/Browser Forum guidelines to intermediate and end-entity certificates
- Improve the security of the Internet by ensuring all ICAs operate using the latest improvements
If you have questions or concerns, please contact your account manager or our support team.
October 13, 2020
ICA certificate chain selection for public OV and EV flex certificates
We are happy to announce that public OV and EV certificates with flex capabilities now support Intermediate CA certificate chain selection.
You can add an option to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues your public OV and EV "flex" certificates.
This option allows you to:
- Set the default ICA certificate chain for each public OV and EV flex certificate.
- Control which ICA certificate chains certificate requestors can use to issue their flex certificate.
Configure ICA certificate chain selection
To enable ICA selection for your account, contact your account manager or our Support team. Then, in your CertCentral account, on the Product Settings page (in the left main menu, go to Settings > Product Settings), configure the default and allowed intermediates for each type of OV and EV flex certificate.
For more information and step-by-step instructions, see ICA certificate chain option for public OV and EV flex certificates.
DigiCert Services API support for ICA certificate chain selection
In the DigiCert Services API, we made the following updates to support ICA selection in your API integrations:
- Created new Product limits endpoint
Use this endpoint to get information about the limits and settings for the products enabled for each division in your account. This includes ID values for each product's default and allowed ICA certificate chains. - Added support for ICA selection to public TLS OV and EV flex certificate order requests
After you configure allowed intermediates for a product, you can select the ICA certificate chain that should issue your certificate when you use the API to submit an order request.
Pass in the ID of the issuing ICA certificate as the value for theca_cert_idparameter in the body of your order request
Example flex certificate request:
For more information about using ICA selection in your API integrations, see OV/EV certificate lifecycle – (Optional) ICA selection.