Filtering by: New feature x clear
new

CT Log monitoring

We are happy to announce that Secure Site Pro certificates now come with access to a CT Log monitoring service. CT Log monitoring allows you to monitor the public CT logs for SSL/TLS certificates issued for the domains on your Secure Site Pro certificate order, in real time.

CT Log monitoring is a cloud service so there is nothing to install or manage. After we've issued your Secure Site Pro certificate and turned CT Log monitoring on for the order, you can start using the service immediately to monitor the domains on the certificate order.

The CT Log monitoring benefit for Secure Site Pro certificates is retroactive. To access your CT Log monitoring for your issued and active Secure Site Pro certificate order, contact your account manager or our support team.

CT Log monitoring helps you:

  • Gain visibility of the SSL/TLS certificates issued for your domains with global monitoring and tracking against the public CT logs.
  • Cut down on time and effort needed to monitor the logs by providing automated checks for DigiCert and non-DigiCert issued certificates.
  • Ensure every certificate issued for your domains is trusted while gaining full oversight of which certificate authority issued each certificate.

The service pulls the discovered SSL/TLS certificates into your CertCentral account, where you can view details about the certificates to quickly identify any misissued certificates for your domains. You can also download copies of the non-DigiCert certificates right from your CertCentral account.

Email notifications

After you've enabled CT Log monitoring for a Secure Site Pro certificate order, you'll receive two types of email notifications: Daily CT log digest and if needed, Urgent notifications. Email notifications are sent to account admins and allow them to check the CT logs for their domains without signing in to their CertCentral account every day.

  • Daily CT log digest
    Scheduled to occur once a day, this digest includes a daily rundown of new DigiCert issued SSL/TLS certificates found in public CT logs. The daily digest is only sent if new DigiCert issued certificates are discovered.
  • Urgent CT log notification
    This urgent notification is sent within minutes any time a non-DigiCert SSL/TLS certificate is issued for a domain on the Secure Site Pro certificate order.

To learn more about what's included with each Secure Site Pro certificate, see Pro TLS/SSL Certificates. To learn more about enabling CT log monitoring for a Secure Site Pro certificate order. see Enable CT log monitoring.

new

CertCentral: Default behavior change

By default, we will no longer use organization unit information included in a CSR to autopopulate the Organization Unit value in OV/EV SSL certificate request forms. When ordering these certificates, you can still manually add organization unit information.

Note: Organization unit (OU) information is not required to purchase an OV/EV SSL certificate. Furthermore, when you include OU information in a certificate request, we are required to perform additional validation. This may delay certificate issuance, including for requests where the organization and domains have been prevalidated.

new

CertCentral: New account setting (Enterprise and Partner)

For CertCentral Enterprise and Partner accounts, we added a new account setting—Autopopolate OU Field. This option allows you to use organization unit information included in a CSR to autopopulate the Organization Unit value in OV/EV SSL certificate request forms.

Note: Enterprise and Partner accounts have a logo identifying the account type: Enterprise logo or Partner logo.

In the left main menu, go to Settings > Preferences. On the Division Preferences page, the new setting is in the Advanced Settings section under Certificate Requests. See our Autopopulate Organization Unit field instructions.

new

New feature: Document Signing certificate renewals

We fixed a bug on the Expiring Certificates page where we provided a Renew Now link for expiring Document Signing (DS) certificate orders. When you clicked Renew Now, it opened an SSL certificate renewal form where you were unable to complete your DS certificate renewal.

Note: To renew your DS certificate, you were required to order a new certificate.

Now, on the Expiring Certificate page when you click Renew Now for an expiring DS certificate order, it opens a DS certificate renewal form where you are able renew your certificate.

To learn more about renewing a DS certificate, see Renew a document signing certificate.

new

We updated the Document Signing (DS) certificate's Order details page and Order details panel adding a new Renew Certificate option making it easier to renew your DS certificate before it expires. Note that the Renew Certificate option doesn't appear on the Order details panel and page until 90 days before it expires.

Order details panel

In the left main menu, click Certificates > Orders. On the Orders page, click the DS certificate order's Quick View link. In the Order details panel, you'll see the new Renew Certificate option.

Order details page

In the left main menu, click Certificates > Orders. On the Orders page, click the DS certificate's order number link. On the Order details page, in the Order Actions dropdown, you'll see the new Renew Certificate option.

November 12, 2019

new

We are happy to announce we've implemented an RSS Feed for the CertCentral Change Log. You can see the new change log feed here: https://docs.digicert.com/change-log/feed/.

The RSS feed returns the 15 most recent change log entries. To make upcoming changes easier to identify, we labeled them Upcoming changes.

The change log RSS feed follows RSS 2.0 specifications and is compatible with RSS 2.0 compliant feed aggregators.

RSS feed reader tip

All major browsers have RSS feed extensions to automatically access your selected RSS feeds and organize the results for you. For example, the Chrome extension RSS Feed Reader was used for the screenshots included in this post.

November 8, 2019

new

We are happy to announce a new addition to the DigiCert Developers portal—Discovery API. We just published our first set of Discovery API endpoints. More will follow as we continue to build out the Discovery API documentation.

Why use it?

  • Access Discovery features without signing into your CertCentral account.
  • Customize the Discovery experience to meet the needs of your organization.
  • Integrate with your existing tools.

Sample of endpoints you can start using now:

Tips and Tricks

  • Discovery API uses this base URL: https://daas.digicert.com/apicontroller/v1/
  • Discovery API requires admin or manager level permissions.
new

In Discovery, we added a new feature—Add root and intermediate CAs—that lets you upload public and private root and intermediate CAs. Use this feature to get more accurate security ratings for certificates chained to them.

If Discovery is unable to locate the root and intermediate CAs for a certificate, it down grades the certificate's security rating. By uploading a copy of the certificate's intermediate and root CAs, the next time Discovery runs a scan that includes that certificate, you'll get a more accurate rating.

Note: Supported certificate formats: .der and .cer

In CertCentral, in the left main menu, click Discovery > Manage Discovery. On the Manage scans page, in the More actions dropdown, click Manage root and intermediate CAs. See Add public and private root and intermediate CAs in our Discovery user guide.

new

In Discovery, we added a new Blacklist feature that lets you exclude specific IP addresses and FQDNs from your scan results. For example, you may want to blacklist a domain in your CDN network.

Note: When you blacklist an IP address or FQDN, its information is excluded from all future account Discovery scans. This feature does not remove information from existing scan results.

In CertCentral, the left main menu, click Discovery > Manage Discovery. On the Manage scans page, in the More actions dropdown, click Manage blacklist. See Blacklist IP addresses and FQDNs in our Discovery user guide.

new

Subaccount management for partners, resellers, and enterprises

Many subaccount features have been available in previous beta releases. With this release, all subaccount management functionality is now fully available in CertCentral.

Partners, resellers, and enterprises with tiered organizational structure can:

  • Create and manage all subaccount details for their retail or enterprise customers or their own autonomous sub-resellers.
  • Specify their own account manager for a subaccount.
  • View subaccount orders and reports through CertCentral console or APIs.
  • Bill orders directly to the subaccount or back to the parent account/subaccount.
  • Customize available products and pricing.
  • Manage commission-based finances, now updated and enhanced in CertCentral.

Where are subaccounts?

  • Go to the SUBACCOUNTS menu in the left navigation in CertCentral.
  • If Subaccounts isn’t visible in your account, contact your account manager or customer support.
new

In our CertCentral API, we added a new Custom Reports API that leverages the powerful GraphQL query language, enabling you to generate comprehensive and customizable data sets for more robust reporting.

Custom Reports API consolidates multiple REST endpoints into a single one, so you can better define the types and fields in your queries so they return only the information needed. Additionally, use it to create reusable query templates for generating and scheduling reports.

To learn more, see Custom Reports API in our Developers portal.

new

We added two new statuses to the Organizations and Organization details pages: validation expires soon, and validation expired. These new statuses make it easier to proactively track your organization validations and make sure they stay up to date.

Now, when you visit the Organizations page (in the sidebar menu click Certificates > Organizations), you can quickly identify organizations with validation that is expiring soon or has already expired. For more details about the expiring or expired organization validation, click the organization name.

fix

We fixed a bug where some accounts were unable to submit organizations for EV CS – Code Signing Organization Extended Validation. The affected accounts only contained EV Code Signing and Code Signing products.

As part of the fix, we split up the EV and EV CS verified contact options. Now, when submitting an organization for EV CS – Code Signing Organization Extended Validation, you can submit the organization's verified contact for EV CS order approvals only. Similarly, when submitting an organization for EV – Extended Organization Validation (EV), you can submit the organization's verified contact for EV SSL certificate order approvals only.

Note: For EV code signing certificate orders, organizations and the organization's verified contacts need to be pre-validated. For more information about organization pre-validation, see our Submit an organization for pre-validation instructions.

new

We added two new features to the Expiring Certificates page (in the sidebar, click Certificates > Expiring Certificates), making it easier to manage renewal notifications for your expiring certificates.

First, we added a Renewal Notices column with an interactive check box. Use this check box to enable or disable renewal notices for an expiring certificate.

Second, we added two Renewal Notices filters: Disabled and Enabled. These filters allow you to see only the certificate orders with renewal notices enabled or disabled.

enhancement

In the DigiCert Services API, we updated the List keys and Get key info endpoints response parameters, enabling you to see the organization associated with your ACME certificate orders.

Now, when you call the List keys and Get key info endpoints, we return the name of the organization (organization_name) associated with the ACME certificate order in the response.

Get key info: example reponse with new parameter

compliance

Industry standards compliance reminder

For public and private certificates, Certificate Authorities (CAs) don't accept abbreviations for these parts of an address in your certificate orders or organization pre-validation requests:

  • State or Province*
  • City or Locality*

*This applies to organization and jurisdiction addresses.

new

We made it easier to define the domain validation scope for your account when submitting your domains for validation (pre-validation or via certificate orders).

On the Division Preferences page, we added two domain validation scope options:

  • Submit exact domain names for validation
    With this option, requests for new domains are submitted for validation exactly as named (i.e., request for sub.example.com is submitted for validation exactly as sub.example.com). Validation for the “higher level” domain (e.g., example.com) also works. This is the default behavior for CertCentral.
  • Restrict validation to base domain only
    This option allows you to restrict domain validation to the base domain (e.g., example.com). For request that include new subdomains (e.g., sub.example.com), we only accept domain validation for the base domain (e.g., example.com). Validation for the subdomain (e.g., sub.example.com) won’t work.

To configure the domain validation scope for your account, in the sidebar menu, click Settings > Preferences. On the Division Preference page, expand Advanced Settings. In the Domain Control Validation (DCV) section, under Domain Validation Scope, you'll see the new settings.

fix

We fixed a bug where we were limiting the maximum allowed number of SANS to 10 on Wildcard SSL certificate reissue and new certificate orders.

Now, when reissuing or ordering a new Wildcard SSL certificate, you can add up to 250 SANs.

new

In the DigiCert Services API, we added two new Order info endpoints. Now, you can use the order ID, the certificate's serial number, or the certificate's thumbprint to view the details for a certificate order.

  • GET https://www.digicert.com/services/v2/order/certificate/{{thumbprint}}
  • GET https://www.digicert.com/services/v2/order/certificate/{{serial_number}}

Currently, these new endpoints only retrieve data for the primary certificate. For more information on the Services API, see our Developers portal.

new

PQC dockerized toolkit guide available now

Secure Site Pro Secure Site Pro certificates come with access to the DigiCert post-quantum cryptographic (PQC) toolkit. To create your own PQC test environment, use one of these options:

Our toolkits contain what you need to create a hybrid SSL/TLS certificate. The hybrid certificate in the toolkits uses a PQC algorithm paired with an ECC algorithm allowing you to test the feasibility of hosting a post-quantum, backwards compatible hybrid certificate on your website.

Note: To access your PQC toolkit, go to your Secure Site Pro Certificate's Order # details page. (In the sidebar menu, click Certificates > Orders. On the Orders page, click the order number link for your Secure Site Pro certificate. On the certificate's order details page, click PQC toolkit.)

To learn more about post-quantum cryptography, see Post-Quantum Cryptography. To learn more about what's included with each Secure Site Pro certificate, see Pro TLS/SSL Certificates.

new

DigiCert is happy to announce we made it easier for DigiCert Accounts using the Retail API to upgrade to our new Certificate Management Platform, DigiCert CertCentralFor free!

To make the upgrade as seamless as possible, we shimmed these Retail API endpoints:

Now, you can upgrade your DigiCert Account without any interruptions to your API integrations. Once you're upgraded, make plans to build new integrations with CertCentral.

  • For more information on the CertCentral Services API, see our Developers portal.

For information about the DigiCert Retail API, see Documentation for the DigiCert Retail API.

new

Secure Site Pro certificates now come with access to the DigiCert post-quantum cryptographic (PQC) toolkit. Our toolkit contains what you need to create a hybrid SSL/TLS certificate. The hybrid certificate in the toolkit uses a PQC algorithm paired with an ECC algorithm allowing you to test the feasibility of hosting a post-quantum, backwards compatible hybrid certificate on your website.

Note: The PQC benefit for Secure Site Pro certificates is retroactive. To access your PQC toolkit, go to your Secure Site Pro Certificate's Order # details page. (In the sidebar menu, click Certificates > Orders. On the Orders page, click the order number link for your Secure Site Pro certificate. On the certificate's order details page, click PQC toolkit.)

To learn more about post-quantum cryptography and our PQC toolkit:

To learn more about what's included with each Secure Site Pro certificate, see Pro TLS/SSL Certificates.

new

In Discovery, we added a Scan for configured cipher suites option to the scan settings that lets you see the cipher suites enabled on a server. When adding or editing a scan, this option is located in the Settings section when you select Choose what to scan. See Set up and run a scan or Edit a scan.

Once your scan completes, the cipher suite information is listed on the Server details page, in the Server details section. (In the sidebar menu, click Discovery > View Results. On the Certificates page, click View endpoints. On the Endpoints page, click the endpoint's IP address /FQDN link. Then, on the Server details page, in the Server details section, click the Ciphers View link.)

Update note: The new Scan for configured cipher suites option is available in the latest sensor version – 3.7.7. After sensor updates are complete, edit the scan Settings, select Choose what to scan, check Scan for configured cipher suites, and then rerun the scan.

enhancement

We improved the user invitation workflow for SAML Single Sign-On (SSO) integrations with CertCentral, enabling you to designate invitees as SSO only users before sending your account user invitations. Now, in the Invite New Users popup window, use the SAML Single Sign-on (SSO) only option to restrict invitees to SAML SSO only.

Note: This option disables all other authentication methods for these users. Additionally, this option only appears if you have SAML enabled for your CertCentral account.

(In the sidebar menu, click Account > User Invitations. On the User Invitations page, click Invite New Users. See SAML SSO: Invite users to join your account.)

Simplified enrollment form

We also simplified the SSO only user enrollment form, removing the password and security question requirements. Now, SSO only invitees need to add only their personal information.

new

We made it easier to see your Discovery certificate scan results from the CertCentral Dashboard in your account, adding the Expiring Certificates Discovered, Certificate Issuers, and Certificates Analyzed By Rating widgets.

Each widget contains an interactive chart that allows you drill down to easily find more information about expiring certificates (e.g., which certificates are expiring in 8-15 days), certificates per issuing CA (e.g., DigiCert), and certificates per security rating (e.g., not secure).

More about Discovery

Discovery uses sensors to scan your network. Scans are centrally configured and managed from inside your CertCentral account.

new

In the DigiCert Services API, we updated the Order info endpoint enabling you to see how the certificate was requested. For certificates requested via the Services API or an ACME Directory URL, we return a new response parameter: api_key. This parameter includes the key name along with key type: API or ACME.

Note: For orders requested via another method (e.g., CertCentral account, Guest Request URL, etc.), the api_key parameter is omitted from the response.

Now, when viewing order details, you'll see the new api_key parameter in the response for orders requested via the API or an ACME Directory URL:

GET https://dev.digicert.com/services-api/order/certificate/{order_id}

Response:

Order info endpoint response parameter

new

We added a new search filter – Requested via – to the Orders page that allows you to search for certificate orders requested via a specific API key or ACME Directory URL.

Now, on the Orders page, use the Requested via filter to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates requested via a specific API key or ACME Directory URL.

(In the sidebar menu, click Certificates > Orders. On the Orders page, click Show Advanced Search. Then, in the Requested via dropdown select the API Key or ACME Directory URL name or type its name in the box.)

enhancement

We improved the API key generation process, adding the ability to restrict the permissions of an API key to a specific set of actions.

When linking a key to a user, you're linking that user's permissions to the key. Now, you can restrict the permissions of that key to subset of actions within that user's role.

For more information, see Generate an API key.

new

We added a new information icon to the API key list on the Account Access page to help you quickly identify API keys with restricted permissions (in the sidebar menu, click Account > Account Access). Clicking the icon allows you to see what integrations the key can be used for.

new

We've added a new Edit API key feature that allows you to edit the description and permissions of an active API key.

To edit an API key, in the sidebar menu, click Account > Account Access. On the Account Access page, under API Keys, click the API Key Name link.

For more information, see Edit an API key.

fix

We fixed a bug on the Guest URL Request a Certificate page, where clicking Order Now redirected you to the DigiCert account sign in page.

Now, when you order a certificate from a Guest URL and click Order Now, your request is submitted to your account administrator for approval. For more information about guest URLs, see Managing Guest URLs.

enhancement

We added the Auto-Renewal User feature to the New Division page that optionally allows you to set a default user for the division's auto-renewal orders when creating a new division. If set, this user replaces the original requester on all division auto-renewal certificate orders and helps prevent auto-renewal interruptions.

In your account, in the sidebar menu, click Account > Divisions. On the Divisions page, click New Division. On the New Division page, in the Auto-Renewal User dropdown, set a default user for all division auto-renewal orders.

new

We are adding a new tool to the CertCentral portfolio—ACME protocol support—that allows you to integrate your ACME client with CertCentral to order OV and EV TLS/SSL certificates.

Note: This is the open beta period for ACME protocol support in CertCentral. To report errors or for help connecting your ACME client to CertCentral, contact our support team.

To access ACME in your CertCentral account, go to the Account Access page (in the sidebar menu, click Account > Account Access) and you'll see a new ACME Directory URLs section.

For information about connecting your ACME client with your CertCentral account, see our ACME user guide.

To turn ACME off for your account, contact your account manager or our support team.

Known issues

For a list of current known issues, see ACME Beta: Known issues.

new

We've added a new Auto-Renewal User feature to the Edit division page that optionally allows you to set a default user for the division's auto-renewal orders. If set, this user replaces the original requester on all division auto-renewal certificate orders and helps prevent auto-renewal interruptions.

(In your account, in the sidebar menu, click Account > Divisions. On the Divisions page, select the division (or click My Division). Edit the division and in the Auto-Renewal User dropdown, set a default user for all division auto-renewal orders.)

enhancement

We improved the automatic certificate renewal feature, adding an "Auto-renewal disabled" notification to the process. If something happens that prevents us from automatically renewing a certificate, we now send an "Auto-renew disabled" email notification, letting you know auto-renewal has been disabled for the order, what will happen now, and how to re-enable auto-renewal for the order.

Note: Automatic certificate renewals are tied to a specific user (order specific or division specific). If that user ever loses permissions to place orders, the automatic certificate renewal process is disabled.

new

Secure Site certificates now come with convenient access to a VirusTotal malware check. Quickly analyze your public domains with 70 plus antivirus scanners and URL/domain blacklist services. Use scan results to identify malware threats so you can take actions to keep your site off blacklists that can cripple site availability and online revenue.

Note: This benefit is retroactive. Go to your Secure Site certificate's Order # detail page to use your new VirusTotal malware check. (In the sidebar menu, click Certificates > Orders. On the Orders page, click the order number link for your Secure Site certificate.)

See Secure Site now with all the benefits of DigiCert to learn more about what's included with each Secure Site certificate.

February 13, 2019

new

We added two new endpoints that allow you to use the order_id to download the current, active certificate for the order.

These endpoints can only be used to get the most recent reissue certificate for an order. These endpoints won't work for downloading duplicate certificates.

Duplicate Certificates Note

To download a duplicate certificate for an order, first use the List order duplicates endpoint to get the duplicate certificate's certificate_id – GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/duplicate.

Then use the Get certificate endpoint to download the duplicate certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform .

Reissue Certificates Note

To download a past reissue certificate (one that is not the current reissue), first use the List order reissues endpoint to get the reissue certificate's certificate_id -- GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue.

Then use the Get certificate endpoint to download the reissue certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform.

API Documentation Note

For more information about these and other endpoints available in the DigiCert Services API, see CertCentral API.

new

We added a new Certificate Authority page that replaces the Intermediates page. To access this new page, in the sidebar menu, click Certificates > Certificate Authority.

Note: This page is where we list all intermediate and root certificates available for your account: Public and Private.

We also made some enhancements to the page. Now when you click the certificate name link, it opens the certificate details panel where you can download the certificate and view more details about it, such as the certificate's signature hash, serial number, and thumbprint.

new

We added a new Add contact feature to the OV SSL/TLS certificate request forms allowing you to add a single technical contact and a single organization contact during the request process.

Previously, you were unable to add contacts when ordering OV SSL/TLS certificates (such as Secure Site SSL and Multi-Domain SSL certificates).

Note: A technical contact is someone we can contact should problems arise while processing your order. An organization contact is someone we can contact when completing the organization validation for your certificate.

enhancement

We enhanced the Add contact feature on the EV SSL/TLS certificate request forms allowing you to add a single technical contact and a single organization contact during the request process.

Previously, you could only add Verified Contacts (for EV) when ordering EV SSL/TLS certificates (such as Secure Site EV and EV Multi-Domain SSL).

Note: A technical contact is someone we can contact should problems arise while processing your order. An organization contact is someone we can contact when completing the organization validation for your certificate.

new

We added a new Cancel Reissue feature enabling you to cancel a pending reissue on a certificate.

On the Orders page (in the sidebar menu, click Certificate > Orders), locate the Reissue Pending certificate request and click its order number link. On the Order # details page, in the Certificate Details section, in the Certificate Actions drop-down list, select Cancel Reissue.

Note: For reissue requests awaiting approval, the approver can just reject the reissue request. For certificate reissues that have already been issued, the administrator must revoke the certificate.

fix

We fixed a bug where standard users were unable to access the domain control validation (DCV) features on their SSL/TLS certificate's Order # details page.

Note: Account administrators and managers were able to access the DCV features on the Order # details pages and complete the DCV for the orders.

Now, when standard users order a certificate for a new domain, they can access the DCV features on the Order # details page.

(In the sidebar menu, click Certificate > Orders. On the orders page locate the pending certificate order and click the order number link. On the Order # details page, click the domain link.)

new

We added two more Domain Control Validation (DCV) methods to the DV certificate Order and Reissue pages: DNS TXT and File.

Note: Previously (unless you are using the DigiCert Services API), you could only use the Email DCV method to prove control over the domains on your DV certificate orders.

Now, when ordering or reissuing a DV certificate, you can choose DNS TXT, File, or Email as the DCV method to complete domain validation for the order.

new

We added new Prove control over domains features to the DV certificates' Order # details page.

Previously, you were unable to take any actions to complete your domain validation on the DV certificates' Order # details page.

Now, you can take more actions to complete the domain validation for the order:

  • Use the DNS TXT, Email, and File DCV methods
  • Resend/send the DCV Emails and choose which email address to send it to
  • Verify your domain's DNS TXT record
  • Verify your domain's fileauth.txt file
  • Choose a different DCV method than the one selected when ordering the certificate

(In the sidebar menu, click Certificates > Orders. On the Orders page, in the Order # column of the DV certificate order, click the order number.)

enhancement

We enhanced the Certificate Details section of the DV certificates' Order # details page adding additional DV certificate information: Serial Number and Thumbprint.

Note: This enhancement is not retroactive. This new information only appears for orders placed after 17:00 UTC time January 15, 2019.

(In the sidebar menu, click Certificates > Orders. On the Orders page, in the Order # column of the DV certificate order, click the order number.)

enhancement

We enhanced the Get order details endpoint enabling the DV certificate's thumbprint and serial number to be returned in the response.

{
"id": "12345",
"certificate":{
"id":123456,
"thumbprint":"{{thumbprint}}",
"serial_number":"{{serial_number}}
...
}

Note: This enhancement is not retroactive. The thumbprint and serial number are only returned for orders placed after 17:00 UTC time January 15, 2019.

For more information, see the Get order details endpoint in the DigiCert Services CertCentral API documentation.

compliance

DigiCert began issuing public SSL certificates containing underscores for a limited time.

  • Maximum 30-day validity for public SSL certificates containing underscores in domain names.
  • Underscores must not be in the base domain ("example_domain.com" is not allowed).
  • Underscores must not be in the left most domain label ("_example.domain.com" and "example_domain.example.com" are not allowed).

For more details, see Retiring Underscores in Domain Names.

new

In the top menu, we added two new contact support options (phone and chat icons) making it easier to contact support from within CertCentral (via email, chat, or phone).

The phone icon provides you with email and phone options. The chat icon provides you with a chat window where you can start a chat with one of our dedicated support team members.

enhancement

We enhanced the sidebar menu, making it easier to see the menu option for the pages you are visiting. Now, when you visit a page in CertCentral, the menu option for that page will have a horizontal blue bar next to it.

fix

We fixed a bug in the Add Organization feature on the SSL/TLS certificate request forms where the validation status (EV and OV validated) was not included for new organizations added and validated as part of the certificate order.

Now, new organizations added when ordering an SSL certificate will show a Validated status.

Note: The organization's validation status doesn't appear until we've fully validated the organization.

new

We added a new search filter Certificate ID to the Orders page that allows you to search for a certificate order using the Certificate ID.

You can now use the Certificate ID to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates.

On the Orders page (in the sidebar menu, click Certificates > Orders), click Show Advanced Search. Then, in the Certificate ID search box, add the Certificate ID and click Go.

new

RapidSSL and GeoTrust DV certificates are available in CertCentral:

  • RapidSSL Standard DV
  • RapidSSL Wildcard DV
  • GeoTrust Standard DV
  • GeoTrust Wildcard DV

Documentation

new

We added a new feature Allow users to add new contacts when requesting TLS certificates that provides you with the flexibility to choose whether standard users, finance managers, and limited users can add a new non-CertCentral account user as a Verified Contact (for EV) when ordering an EV TLS/SSL certificate from inside their account or when using a guest URL.

Previously, the only way to prevent these user roles from adding a new non-CertCentral account user as a verified contact during the order process was to edit the request and select an existing contact for the order or reject the certificate request.

Now, you can control whether the User, Finance Manager, and Limited User roles can add a new non-CertCentral account user as a verified contact from the EV SSL/TLS certificate request pages. This feature doesn't remove the option from the EV SSL/TLS certificate order pages for the Administrator and Manager roles.

On the Division Preferences page (Settings > Preferences). In the Certificate Request section (expand Advanced Settings), under Add New Contacts, uncheck Allow users to add new contacts when requesting TLS certificates and then click Save Settings.

Note: This change does not remove the ability to add an existing contact (CertCentral account users or non-CertCentral account users) as the verified contact to an order as this is required for all EV SSL/TLS certificate orders.

enhancement

We enhanced the Allow users to add new organizations when requesting TLS certificate feature providing you with the flexibility to choose whether standard users, finance managers, and limited users can add a new organization when ordering a TLS certificate (OV and EV) from inside their account or when using a guest URL.

Previously, the feature removed the ability to add a new organization for all user roles: Administrator, Manager, Standard User, Finance Manager, and Limited User.

Now, the Allow users to add new organizations when requesting TLS certificate feature only affects the User, Finance Manager, and Limited User roles ability to add new organizations from the certificate request pages. Administrator and Manager roles retain the ability to add new organizations whether this feature is enabled or disabled.

On the Division Preferences page (Settings > Preferences). In the Certificate Request section (expand Advanced Settings), under Add New Organization, uncheck Allow users to add new organizations when requesting TLS certificates and then click Save Settings.

Note: This change does not remove the ability to add an existing, pre-validated organization to an order as this is required for all OV and EV TLS certificate orders.

enhancement

We enhanced our SSL/TLS and client certificate product offerings, enabling you to set a custom validity period (in days) when ordering one of these certificates. Previously, you could only choose a custom expiration date.

Custom validity periods start on the day we issue the certificate. Certificate pricing is prorated to match the custom certificate length.

Note: Custom certificate lengths can't exceed the industry allowed maximum lifecycle period for the certificate. For example, you can't set a 900-day validity period for an SSL/TLS certificate.

enhancement

We enhanced the SSL/TLS and Client certificate endpoints to include a new validity_days parameter that allows you to set the number of days that the certificate is valid for.

Parameter Priority Note: If you include more than one certificate validity parameter in your request, we prioritize the certificate validity parameters in this order: custom_expiration_date > validity_days > validity_years.

For DigiCert Services API documentation, see CertCentral API.

new

We added a new Order Management - List Order Reissues API endpoint that allows you to view all the reissue certificates for a certificate order. See the List order reissues endpoint.

new

We added a new feature that allows you to reissue Document Signing certificates [Document Signing – Organization (2000) and Document Signing – Organization (5000)].

Note: Previously, you couldn't reissue a Document Signing certificate. The only workaround was to revoke and replace your Document Signing certificate.

Now, you can go to Orders page (in the sidebar menu, click Certificates > Orders), find your Document Signing certificate, and on its Order# details page, reissue your certificate as needed.

October 17, 2018

new

We added a new Order Management - Revoke Certificate API endpoint that allows you to use the order ID to revoke all certificates associated with a single order, making it easier to use the API to revoke an issued certificate. This assures that any duplicates or reissues associated with the order are revoked all at once.

Note: After you submit the certificate revocation request, an administrator will need to approve the request before DigiCert can revoke the certificates associated with the order. See the Update Request Status API endpoint.

For more information about the new endpoint and other publicly available endpoints, see the Revoke Certificate API endpoint in our CertCentral API documention.

new

We added a new feature that provides the flexibility to choose whether users can add a new organization when ordering a TLS certificate (OV and EV) from inside their account or when using a guest URL.

Note: Previously, the only way you could prevent users from adding a new organization during the order process was to edit the request and select an existing organization for the order or reject the certificate request.

With this new feature, you can disable or enable the ability for users to add new organizations from the certificate request pages.

On the Division Preferences page (Settings > Preferences). In the Certificate Request section (expand Advanced Settings), under Add New Organization, uncheck Allow users to add new organizations when requesting TLS certificates and then click Save Settings.

Note: This change does not remove a user's ability to add an existing, pre-validated organization to an order as this is required for all OV and EV TLS certificate orders.

new

Secure Site TLS/SSL certificates are available in CertCentral:

  • Secure Site SSL
  • Secure Site EV SSL
  • Secure Site Multi-Domain SSL
  • Secure Site EV Multi-Domain SSL
  • Secure Site Wildcard SSL

To activate Secure Site certificates for your CertCentral account, contact your Sales representative.

Benefits included with each Secure Site certificate:

  • Priority validation
  • Priority support
  • Two premium site seals
  • Industry-leading warranties

To learn more about our Secure Site certificates, see DigiCert Secure Site Overview.
Additional Resources:

fix

Updates to the full SHA256 EV hierarchy certificate profile

On September 27, 2018, we removed the Symantec policy OID from EV TLS certificates issued from the full SHA256 EV hierarchy [DigiCert Global G2 Root => DigiCert Global G2 Intermediate => EV TLS/SSL certificate].

Problem: Chrome bug on macOS

July 2018, we discovered a bug in Chrome on macOS where it wasn't showing the EV indicator for EV TLS certificate with more than two policy OIDs – https://bugs.chromium.org/p/chromium/issues/detail?id=867944.

Solution

We removed the Symantec policy OID from the full SHA256 EV hierarchy certificate profile. With this change, Chrome on macOS again showed the EV indicator for the EV TLS certificates issued from the full SHA256 EV hierarchy.

Affected EV TLS certificates

EV TLS certificates (from the full SHA256 EV hierarchy) issued after January 31, 2018 and prior to September 27, 2018 contain these three policy OIDs in the Certificate Extension - Certificate Policies:

  • 2.16.840.1.114412.2.1 (DigiCert OID)
  • 2.16.840.1.113733.1.7.23.6 (Symantec OID)
  • 2.23.140.1.1 (CAB/F OID)

What do I need to do?

  • Do you have an EV TLS certificate that is not showing the EV indicator in Chrome on macOS?
    Please replace (reissue) your EV TLS certificate to show the EV indicator in Chrome on macOS.
    Full SHA256 EV TLS certificates issued as of September 27, 2018 contain only two policy OIDs in the Certificate Extension - Certificate Policies:
    • 2.16.840.1.114412.2.1 (DigiCert OID)
    • 2.23.140.1.1 (CAB/F OID)
  • What about other types of certificates?
    For all other types of certificates, no action is required.

September 18, 2018

new

We added support for IPv6 addresses (abbreviated and full).

You can now order public and private OV TLS/SSL certificates (SSL, Multi-Domain SSL, and Wildcard SSL, Private SSL, etc.) and include an IPv6 address as the common name or a SAN.

Note: IPv6 addresses aren't supported for EV TLS/SSL certificates (EV SSL and EV Multi-Domain SSL).

September 13, 2018

enhancement

We enhanced the Add Organization step of the TLS/SSL certificate ordering process.

Previously, you were required to add a new organization before requesting your certificate (Certificates > Organizations). Additionally, the new organization was not available on the Certificate Request page until we completed its organization validation.

With this improvement, you can add a new organization as part of the request process. Note that because the organization is not pre-validated, DigiCert will need to validate the new organization before we can issue your certificate.

Note: When adding a new organization from a Certificate Request page, the requestor (person ordering the certificate) becomes the contact for the new organization.

When ordering a TLS/SSL certificate, you can still choose to use an existing, pre-validated organization.

Editing a Request

Before a TLS/SSL certificate request is approved, you can Edit the request and add a new organization. The person who adds the new organization becomes the contact for the new organization.

new

We added a new Add Contacts feature to the EV TLS/SSL certificate request process that lets you assign an existing CertCentral user (admin, manager, finance manager, or user) as the verified EV contact for the organization as part of the request process.

Previously, you were required to assign a verified EV contact to an organization before requesting your certificate (Certificates > Organizations).

Allow non-CertCentral account users to be used as verified contacts enabled

On the Division Preferences page (Settings > Preferences), in the Advance Settings section, under Verified Contacts, you can allow non-CertCentral account users to be used as verified contacts (check Allow non-DigiCert users to be used as verified contacts).
With the non-CertCentral user feature enabled, when adding verified contacts as part of the EV certificate request process, you will see two options: Existing Contact and New Contact. The Existing Contact option lets you assign a CertCenrtal user as the verified EV contact. The New Contact option lets you enter information for a non-CertCentral account user.

August 28, 2018

new

New Change CSR feature added. This feature allows you to change the CSR on pending certificate orders (after they've been approved and before they've been issued).

On the Orders page (Certificates > Orders), locate the pending certificate order and click its Order number link. On the Order details page, in the Validation in Progress section under You Need To, click the Change CSR link to change the CSR.

Note: For certificate request awaiting approval, you can change the CSR before it's been approved. On the Requests page (Certificates > Requests), locate the pending certificate request and click its Order number link. In the Request details pane on the right, click the Edit link to change the CSR.

CertCentral API: New Change CSR Endpoint

We've also added a Change CSR endpoint that allows those using the DigiCert Services API to change the CSR on a pending SSL/TLS certificate. For more information about this new endpoint, see Order Management – Add CSR in our Documentation for the DigiCert Services API.

new

Beta roll out of language support in CertCentral.

Language support allows you to change and save your CertCentral platform language preference.

CertCentral Platform Languages:

  • Deutsch
  • Español
  • Français
  • Italiano
  • 日本語
  • 한국어
  • Português
  • Русский
  • 简体中文
  • 繁體中文
  • English

Want to try out the language support coming to CertCentral?

In your account, in the top right corner, in the "your name" drop-down list, select My Profile. On the Profile Settings page, in the Language drop-down list, select one of the languages and then click Save Changes.

See CertCentral: Change and Save Your Language Preference.

July 23, 2018

new

New Cancel Order feature added. This feature enables you to cancel pending certificate orders (after they have been approved and before they have been issued).

On the Orders page (in the sidebar menu, click Certificate > Orders), locate the pending certificate order. Then on the Order details page, in the Certificate Actions section, you can cancel it.

Note: For certificate requests awaiting approval, an approver must reject the request. For certificates that have been issued, an administrator must revoke the certificate.

July 6, 2018

new

New advanced search filter added to the Orders page (in the sidebar menu, click Certificate > Orders and then on the Orders page, click the Show Advanced Search link).

This feature enables you to search for client certificates by the recipient’s email address.

April 16, 2018

new

New feature added to pending orders' details page (click Certificates > Orders and then click a pending order's number link). This feature enables you to complete the domain control validation (DCV) for domains on pending orders.

When you see an order is waiting on domain validation to be completed before it can be issued, click on the pending domain link to open the Prove Control Over Domain popup window. In this window, you can select or change your DCV method and complete that domain's validation (send or resend emails, check DNS TXT record, etc.). See Domain Validation (Pending Order): Domain Control Validation (DCV) Methods.

December 19, 2017

new

DigiCert makes CT Log Yeti publicly available. Yeti is a new, highly scalable, high-performance Certificate Transparency (CT) log.

This CT log is composed of five logs that are sharded in one-year increments based on certificate expiration. Below are the CT log endpoint URLs with their certificate expiration range with their certificate expiration range.

More details »

October 6, 2017

new

Added a new Retrieve Order Validation endpoint; allows you to view the status of DCV and Organization validations for a specific Order.

/services/v2/order/certificate/{order_id}/validation

More details »

October 3, 2017

new

New immediate certificate issuance feature added to the certificate request API endpoints. See CertCentral Immediate Certificate Issuance Feature.

September 26, 2017

new

New feature included in the "help" (?) menu drop-down; added a link to the new Change Log page.

fix

Fixed API bug for the Order Details endpoint. Response body now returns the two renewal fields for client certificates:

"is_renewal": false
"renewed_order_id": 1234567

More details »

August 4, 2017

new

New feature included in the "help" (?) menu drop-down; added a link to the DigiCert CertCentral Getting Started Guide.