We improved the SAML SSO-only users' integration with the CertCentral Services API, adding an account setting that allows you to grant SSO-only users API access. On the SAML Sign-on (SSO) page, under Configure SSO Settings for users, you'll now see the Enable API access for SSO-only users check box (in the sidebar menu, click Settings > Single Sign-On). See Configure SAML Single Sign-On.
Note: This setting allows SSO-only users with API keys to bypass Single Sign-on. Disabling API access for SSO-only users doesn't revoke existing API keys. It only blocks the creation of new API keys.
We improved the user invitation workflow for SAML Single Sign-On (SSO) integrations with CertCentral, enabling you to designate invitees as SSO only users before sending your account user invitations. Now, in the Invite New Users popup window, use the SAML Single Sign-on (SSO) only option to restrict invitees to SAML SSO only.
Note: This option disables all other authentication methods for these users. Additionally, this option only appears if you have SAML enabled for your CertCentral account.
(In the sidebar menu, click Account > User Invitations. On the User Invitations page, click Invite New Users. See SAML SSO: Invite users to join your account.)
Simplified enrollment form
We also simplified the SSO only user enrollment form, removing the password and security question requirements. Now, SSO only invitees need to add only their personal information.
We made it easier to see your Discovery certificate scan results from the CertCentral Dashboard in your account, adding the Expiring Certificates Discovered, Certificate Issuers, and Certificates Analyzed By Rating widgets.
Each widget contains an interactive chart that allows you drill down to easily find more information about expiring certificates (e.g., which certificates are expiring in 8-15 days), certificates per issuing CA (e.g., DigiCert), and certificates per security rating (e.g., not secure).
More about Discovery
Discovery uses sensors to scan your network. Scans are centrally configured and managed from inside your CertCentral account.
In the DigiCert Services API, we updated the Order info endpoint enabling you to see how the certificate was requested. For certificates requested via the Services API or an ACME Directory URL, we return a new response parameter: api_key. This parameter includes the key name along with key type: API or ACME.
Note: For orders requested via another method (e.g., CertCentral account, Guest Request URL, etc.), the api_key parameter is omitted from the response.
Now, when viewing order details, you'll see the new api_key parameter in the response for orders requested via the API or an ACME Directory URL:
We added a new search filter – Requested via – to the Orders page that allows you to search for certificate orders requested via a specific API key or ACME Directory URL.
Now, on the Orders page, use the Requested via filter to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates requested via a specific API key or ACME Directory URL.
(In the sidebar menu, click Certificates > Orders. On the Orders page, click Show Advanced Search. Then, in the Requested via dropdown select the API Key or ACME Directory URL name or type its name in the box.)
We fixed a SAML Single Sign-on (SSO) bug where some Single Sign-on only users were being prompted to reset their expired non-existent CertCentral password.
Note: This prompt appeared only after they had signed in to their account. These SSO only users could still access all account features and perform all relevant tasks.