Filtering by: SSL certificates x clear
enhancement

We improved our Basic and Secure Site single domain certificate offerings (Standard SSL, EV SSL, Secure Site SSL, and Secure Site EV SSL), adding the Include both [your-domain].com and www. [your-domain].com in the certificate option to these certificates' order, reissue, and duplicate forms. This option allows you to choose whether to include both versions of the common name (FQDN) in these single domain certificates for free.

  • To secure both versions of the common name (FQDN), check Include both [your-domain].com and www. [your-domain].com in the certificate.
  • To secure only the common name (FQDN), uncheck Include both [your-domain].com and www. [your-domain].com in the certificate.

See Order your SSL/TLS certificates.

Works for subdomains too

The new option allows you to get both versions of base and subdomains. Now, to secure both versions of a subdomain, add the subdomain to the Common Name box (sub.domain.com) and check Include both [your-domain].com and www. [your-domain].com in the certificate. When DigiCert issues your certificate, it will include both versions of the subdomain on the certificate: [sub.domain].com and www.[sub.doman].com.

Removed Use Plus Feature for Subdomains

The Include both [your-domain].com and www. [your-domain].com in the certificate option makes the Plus Feature -- Use Plus Feature for Subdomains obsolete. So, we removed the option from the Division Preferences page (in the sidebar menu, click Settings > Preferences).

enhancement

In the DigiCert Services API, we updated the Order OV/EV SSL, Order SSL (type_hint), Order Secure Site SSL, Order Private SSL, Reissue certificate, and Duplicate certificate endpoints listed below. These changes provide more control when requesting, reissuing, and duplicating your single domain certificates, allowing you choose whether to include a specific additional SAN on these single domain certificates for free.

  • /ssl_plus
  • /ssl_ev_plus
  • /ssl_securesite
  • /ssl_ev_securesite
  • /private_ssl_plus
  • /ssl*
  • /reissue
  • /duplicate

*Note: For the Order SSL (type_hint) endpoint, only use the dns_names[] parameter as described below to add the free SAN.

To secure both versions of your domain ([your-domain].com and www. [your-domain].com), in your request, use the common_name parameter to add the domain ([your-domain].com) and the dns_names[] parameter to add the other version of the domain (www. [your-domain].com).

When DigiCert issues your certificate, it will secure both versions of your domain.

example SSL certificte request

To secure only the common name (FQDN), omit the dns_names[] parameter from your request.

new

We've added a new certificate profile option, OCSP Must-Staple, that allows you to include the OCSP Must-Staple extension in OV and EV SSL/TLS certificates. Once enabled for your account, the Include the OCSP Must-Staple extension in the certificate option appears on your SSL/TLS certificate request forms under Additional Certificate Options.

Note: Browsers with support for OCSP must-staple may display a blocking interstitial to users accessing your site. Ensure that your site is configured to properly and robustly serve stapled OCSP Responses before installing the certificate.

To enable a certificate profile for your account, reach out to your account representative or contact our Support team.

Other available certificate profile options

If enabled for your account, these profile options appear on your SSL/TLS certificate request forms under Additional Certificate Options.

  • Intel vPro EKU
    Allows you to include the Intel vPro EKU field in OV SSL/TLS certificates.
  • KDC/SmartCardLogon EKU
    Allows you to include the KDC/SmartCardLogon EKU (Extended Key Usage) field in OV SSL/TLS certificates.
  • HTTP Signed Exchange
    Allows you to include the CanSignHTTPExchanges extension in OV and EV SSL/TLS certificate (see Improve your AMP URLs with Signed HTTP Exchange).
  • Delegated Credentials
    Allows you to include the DelegationUsage extension in OV and EV SSL/TLS certificates.
new

We've added a new certificate profile option, Delegated Credentials, that allows you to include the DelegationUsage extension in OV and EV SSL/TLS certificates. Once enabled for your account, the Include the DelegationUsage extension in the certificate option appears on your SSL/TLS certificate request forms under Additional Certificate Options.

To enable a certificate profile for your account, reach out to your account representative or contact our Support team.

Background

The Delegated Credentials for TLS extension is under active development within the Internet Engineering Task Force (IETF). In order to support interoperability testing, we’ve added the ability to issue certificates compliant with the current draft specification. Note that there may be multiple changes to the draft as industry development continues.

Other available certificate profile options

If enabled for your account, these profile options appear on your SSL/TLS certificate request forms under Additional Certificate Options.

  • Intel vPro EKU
    Allows you to include the Intel vPro EKU field in an OV SSL/TLS certificate.
  • KDC/SmartCardLogon EKU
    Allows you to include the KDC/SmartCardLogon EKU (Extended Key Usage) field in an OV SSL/TLS certificate.
  • HTTP Signed Exchange
    Allows you to include the CanSignHTTPExchanges extension in an OV and EV SSL/TLS certificate (see Improve your AMP URLs with Signed HTTP Exchange).
  • OCSP Must-Staple
    Allows you to include the OCSP Must-Staple extension in OV and EV SSL/TLS certificates.
enhancement

We enhanced the DigiCert Services API request endpoints enabling you to get faster responses to your certificate requests.

enhancement

We made it easier to Add Contacts for OV certificate orders (Standard SSL, Secure Site SSL, etc.). Now when you order an OV certificate, we populate the Organization Contact card for you. If needed, you can add a technical contact.

  • When adding a CSR that includes an existing organization in your account, we populate the Organization Contact card with the contact assigned to that organization.
  • When you manually add an existing organization, we populate the Organization Contact card with the contact assigned to that organization.
  • When you add a new organization, we populate the Organization Contact card with your contact information.

To use a different organization contact, delete the one populated automatically and manually add one.

enhancement

We made it easier to Add Contacts for EV certificate orders (EV SSL, Secure Site EV SSL, etc.). Now when you order an EV certificate, we will populate the Verified Contact cards for you if EV verified contact information is available in your account. If needed, you can add organization and technical contacts.

  • When adding a CSR that includes an existing organization in your account, we populate the Verified Contact card with the EV verified contacts assigned to that organization.
  • When you manually add an existing organization, we populate the Verified Contact card with the EV verified contacts assigned to that organization.

Assigning Verified Contacts to an organization is not a prerequisite for adding an organization. There may be instances were verified contact information won't be available for an organization. In this case, manually add the Verified Contacts.

new

We've added a new certificate profile option, KDC/SmartCardLogon EKU, that allows you to include the KDC and SmartCardLogon EKUs (Extended Key Usage) in an OV SSL/TLS certificate. Once enabled for your account, the Include the KDC/SmartCardLogon EKU (Extended Key Usage) field in the certificate option appears on your SSL/TLS certificate request forms under Additional Certificate Options.

To enable a certificate profile for your account, reach out to your account representative or contact our Support team.

Note: Previously, this feature was only available through the DigiCert Services API (see CertCentral API).

Other available certificate profile options

If enabled for your account, these profile options appear on your SSL/TLS certificate request forms under Additional Certificate Options.

  • Intel vPro EKU
    Allows you to include the Intel vPro EKU field in an OV SSL/TLS certificate.
  • HTTP Signed Exchange
    Allows you to include the CanSignHTTPExchanges extension in an OV and EV SSL/TLS certificate (see Improve your AMP URLs with Signed HTTP Exchange).
new

We added a new Add contact feature to the OV SSL/TLS certificate request forms allowing you to add a single technical contact and a single organization contact during the request process.

Previously, you were unable to add contacts when ordering OV SSL/TLS certificates (such as Secure Site SSL and Multi-Domain SSL certificates).

Note: A technical contact is someone we can contact should problems arise while processing your order. An organization contact is someone we can contact when completing the organization validation for your certificate.

enhancement

We enhanced the Add contact feature on the EV SSL/TLS certificate request forms allowing you to add a single technical contact and a single organization contact during the request process.

Previously, you could only add Verified Contacts (for EV) when ordering EV SSL/TLS certificates (such as Secure Site EV and EV Multi-Domain SSL).

Note: A technical contact is someone we can contact should problems arise while processing your order. An organization contact is someone we can contact when completing the organization validation for your certificate.

enhancement

We enhanced the add existing organization feature of the SSL/TLS certificate order process, enabling you to filter the existing organization list to see only organizations that are fully validated.

Note: If your CSR includes an organization currently used in your account, the Organization card auto populates with the organization's information contained in your account.

To manually add an existing organization when ordering your SSL/TLS certificate, click Add Organization. In the Add Organization window, check Hide non-validated organizations to filter the organizations so only the fully validated ones are shown.

Note: If you have more than nine active organizations in your account, the filter also works for the Organization drop-down list.

enhancement

We enhanced the Organization Unit(s) feature of the SSL/TLS certificate order process, enabling you to add multiple organization units. Previously, you could only add one organization unit.

Note: The Organization Unit(s) field on the request form will be auto populated with the values from your CSR.

To manually add organization units when ordering your SSL/TLS certificate, expand Additional Certificate Options and in the Organization Unit(s) field, you can now add one or more organization units.

Note: Adding organization units is optional. You can leave this field blank. However, if you do include organization units in your order, DigiCert will need to validate them before we can issue your certificate.

fix

We fixed a Custom Order Fields* bug preventing the feature from working properly when deactivating, activating, changing a field from required to optional, and changing a field from optional to required.

*Custom Order Fields is disabled by default. To enable this feature for your CertCentral account, please contact your DigiCert account representative. See Managing Custom Order Form Fields in the Advanced CertCentral Getting Started Guide.

enhancement

We fixed a bug on the TLS/SSL certificate order forms where adding a CSR only auto populated the Common Name field. While fixing this bug, we enhanced the CSR upload feature to also auto populate the Organization field.

We now use information from your CSR to auto populate these order form fields: Common Name, Other Hostnames (SANs), Organization Unit (OU), and Organization.

You can still change the information in these fields as needed (for example, you can add or remove SANs).

Organization field note

When you include an organization currently used in your account, the Organization card auto populates with the organization's information contained in your account.

enhancement

We enhanced the add new organization feature of the TLS/SSL certificate order process, enabling you to edit the details of a newly added organization.

Previously, after adding a new organization on the Certificate Request page, you were unable to go back and edit the organization's details. To edit the organization's details, you had to delete the organization and re-add it with the correct information.

With this improvement, you may now edit the newly added organization details. Click the edit icon (pencil), and you can modify the organization's details before submitting your order.

compliance

Industry standards compliance change. For publicly trusted certificates, underscores ( _ ) can no longer be included in subdomains. RFC 5280 now enforced for subdomains as well.

See Publicly Trusted Certificates – Data Entries that Violate Industry Standards.