December 31, 2022
DIGICERT 2022 MAINTENANCE SCHEDULE
To make it easier to plan your certificate-related tasks, we scheduled our 2022 maintenance windows in advance. See DigiCert 2022 scheduled maintenance—this page is kept up to date with all maintenance schedule information.
With customers worldwide, we understand there is not a "best time" for everyone. However, after reviewing the data on customer usage, we selected times that would impact the fewest amount of our customers.
About our maintenance schedule
- Maintenance is scheduled for the first weekend of each month unless otherwise noted.
- Each maintenance window is scheduled for 2 hours.
- Although we have redundancies in place to protect your service, some DigiCert services may be unavailable.
- All normal operations will resume once maintenance is completed.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
If you need more information regarding these maintenance windows, contact your account manager or DigiCert support team.
February 12, 2022
Expanding Range of IP Addresses Used for DigiCert Services
As part of our scheduled maintenance on February 12, 2022, 22:00 – 24:00 MST (February 13, 2022, 05:00 - 07:00 UTC), DigiCert is expanding the range of IP addresses we use for our services. These additional IP addresses are part of our efforts to increase service uptime and reduce the need for service downtime during scheduled maintenance.
What do I need to do?
If your company uses allowlists*, update them to include the block of IP addresses listed below by February 12, 2022, to keep your DigiCert services and API integrations running as expected.
*Note: Allowlists are lists for firewalls that only allow specified IP addresses to perform certain tasks or connect to your system.
Additional IP addresses
Add this range of IP addresses to your allowlist: 216.168.240.0/20
Note: We are not replacing or removing any IP addresses. We are only expanding the range of IP Addresses we use to deliver our services.
Affected Services:
- CertCentral/Services API
- ACME
- Discovery/API
- Discovery sensor firewall settings
- ACME Automation/API
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- API access URL
- Direct Cert Portal/API
- DigiCert website
- Validation services
- PKI Platform 8
- PKI Platform 7 (Japan and Australia)
- QuoVadis TrustLink
- DigiCert ONE
- Account Manager
- CA Manager
- IoT Device Manager
- Document Signing Manager
- Secure Software Manager
- Enterprise PKI Manager
- Automation Manager
For easy reference, see our knowledgebase article, Expanding Range of IP Addresses for DigiCert Services. If you have questions, please contact your account manager or DigiCert Support.
January 8, 2022
Upcoming Scheduled Maintenance
DigiCert will perform scheduled maintenance on January 8, 2022, between 22:00 – 24:00 MST (January 9, 2022, between 05:00 – 07:00 UTC). Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- If you use the APIs for immediate certificate issuance and automated tasks, expect interruptions.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2022 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
December 31, 2021
To make it easier to plan your certificate related tasks, we scheduled our 2021 maintenance windows in advance. See DigiCert 2021 scheduled maintenance—this page is kept up to date with all maintenance schedule information.
With customers all over the world, we understand there is not a best time for everyone. However, after reviewing the data on customer usage, we selected times that would impact the fewest amount of our customers.
About our maintenance schedule
- Maintenance is scheduled for the first weekend of each month, unless otherwise noted.
- Each maintenance window is scheduled for 2 hours.
- Although we have redundancies in place to protect your service, some DigiCert services may be unavailable.
- All normal operations will resume once maintenance is completed.
If you need more information regarding these maintenance windows, contact your account manager or DigiCert support team. To get live updates, subscribe to the DigiCert Status page.
December 7, 2021
CertCentral Report Library now available
We are happy to announce the CertCentral Report Library is now available for CertCentral Enterprise and CertCentral Partner.* The Report Library is a powerful reporting tool that allows you to download more than 1000 records at a time. Use the Report Library to build, schedule, organize, and export reports to share and reuse.
The Report Library includes six customizable reports: Orders, Organizations, Balance history, Audit log, Domains, and Fully qualified domain names (FQDN). When building reports, you control the details and information that appear in the report, configure the columns and column order, schedule how often you want the report to run (once, weekly, or monthly), and choose the report format (CSV, JSON, or Excel). In addition, you receive notices when the report is ready for download in your account.
To build your first report:
- In your CertCentral account, in the main menu, select Reports*.
Note: To use the Report Library, you must be a CertCentral administrator. CertCentral Managers, Finance Managers, Standard Users, and Limited Users do not have access to Reports in their account. - On the Report library page, select Build a report.
To learn more about building reports:
*Note: Don't see the Report Library in your account? Contact your account manager or our support team for help.
CertCentral Report Library API also available
We're pleased to announce the release of the CertCentral Report Library API! This new API service makes it possible to leverage key features of the Report Library in your CertCentral API integrations, including building reports and downloading report results*.
See our Report Library API documentation to learn more about including the Report Library in your API integrations.
*Note: To use the CertCentral Report Library API, Report Library must be enabled for your CertCentral account. For help activating the Report Library, contact your account manager or our support team.
Bugfix: Unique organization name check did not include assumed name
We updated our unique organization name check to include the assumed name (doing business as name) when creating an organization.
Before, in CertCentral and the CertCentral Services API, when you tried to create an organization with the same name as an existing organization, we returned an error and would not let you create the organization, even if the assumed name (DBA) was different.
Now, when you create an organization, we include the assumed name in the unique organization check. Therefore, you can create organizations with the same name, as long as each organization has a unique assumed name.
For example:
- First organization: No assumed name
- Name: YourOrganization
- Assumed name:
- Second organization: Name plus unique assumed name
- Name: YourOrganization
- Assumed name: OrganizationAssumedName
Creating organizations
In CertCentral and the CertCentral Services API, you can create an organization to submit for prevalidation or when you order a TLS/SSL certificate. This change applies to both processes.
CertCentral: DigiCert now issues client certificates from the DigiCert Assured ID Client CA G2 intermediate CA certificate
To remain compliant with industry standards, DigiCert had to replace the intermediate CA (ICA) certificate used to issue CertCentral client certificates.
CertCentral client certificate profiles that used the DigiCert SHA2 Assured ID CA intermediate CA certificate now use the DigiCert Assured ID Client CA G2 intermediate CA certificate. This change also changes the root certificate from DigiCert Assured ID Root CA to DigiCert Assured ID Root G2.
Old ICA and root certificates
- (ICA) DigiCert SHA2 Assured ID CA
- (Root) DigiCert Assured ID Root CA
New ICA and root certificates
- (ICA) DigiCert Assured ID Client CA G2
- (Root) DigiCert Assured ID Root G2
For more information, see DigiCert ICA Update. To download a copy of the new intermediate CA certificate, see DigiCert Trusted Root Authority Certificates.
Do you still need your client certificate to chain to the DigiCert Assured ID Root CA certificate? Contact your account representative or DigiCert Support.
December 4, 2021
Upcoming Scheduled Maintenance
DigiCert will perform scheduled maintenance on December 4, 2021, between 22:00 – 24:00 MST (December 5, 2021, between 05:00 – 07:00 UTC). Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
November 16, 2021
Industry changes to file-based DCV (HTTP Practical Demonstration, file auth, file, HTTP token, and HTTP auth)
To comply with new industry standards for the file-based domain control validation (DCV) method, you can only use the file-based DCV to demonstrate control over fully qualified domain names (FQDNs), exactly as named.
To learn more about the industry change, see Domain validation policy changes in 2021.
How does this affect me?
As of November 16, 2021, you must use one of the other supported DCV methods, such as Email, DNS TXT, and CNAME, to:
- Validate wildcard domains (*.example.com)
- To include subdomains in the domain validation when validating the higher-level domain. For example, if you want to cover www.example.com, when you validate the higher-level domain, example.com.
- Prevalidate entire domains and subdomains.
To learn more about the supported DCV method for DV, OV, and EV certificate requests:
CertCentral: Pending certificate requests and domain prevalidation using file-based DCV
Pending certificate request
If you have a pending certificate request with incomplete file-based DCV checks, you may need to switch DCV methods* or use the file-based DCV method to demonstrate control over every fully qualified domain name, exactly as named, on the request.
*Note: For certificate requests with incomplete file-based DCV checks for wildcard domains, you must use a different DCV method.
To learn more about the supported DCV methods for DV, OV, and EV certificate requests:
- Supported DCV methods for validating domains on certificate OV and EV certificate requests
- Supported DCV methods for validating the domains on DV SSL certificate orders
Domain prevalidation
If you plan to use the file-based DCV method to prevalidate an entire domain or entire subdomain, you must use a different DCV method.
To learn more about the supported DCV methods for domain prevalidation, see Supported domain control validation (DCV) methods for domain prevalidation.
CertCentral Services API
If you use the CertCentral Services API to order certificates or submit domains for prevalidation using file-based DCV (http-token), this change may affect your API integrations. To learn more, visit File-based domain control validation (http-token).
November 6, 2021
Upcoming Schedule Maintenance
DigiCert will perform scheduled maintenance on November 6, 2021, between 22:00 – 24:00 MDT (November 7, 2021, between 04:00 – 06:00 UTC).
CertCentral infrastructure-related maintenance downtime
We will start this infrastructure-related maintenance between 22:00 and 22:10 MDT (04:00 and 04:10 UTC). Then, for approximately 30 minutes, the following services will be down:
DV certificate issuance for CertCentral, ACME, and ACME agent automation
- DV certificate requests submitted during this time will fail
- APIs will return a "cannot connect" error
- Failed requests should be resubmitted after services are restored
CIS and SCEP
- Certificate Issuing Service (CIS) will be down
- Simple Certificate Enrollment Protocol (SCEP) will be down
- DigiCert will be unable to issue certificates for CIS and SCEP
- APIs will return a "cannot connect" error
- Requests that return "cannot connect" errors should be resubmitted after services are restore
QuoVadis TrustLink certificate issuance
- TrustLink certificate requests submitted during this time will fail
- However, failed requests will be added to a queue for processing later
- Queued-up requests will be processed after services are restored, as required
This maintenance only affects DV certificate issuance, CIS, SCEP, and TrustLink certificate issuance. It does not affect any other DigiCert platforms or services .
PKI Platform 8 maintenance
We will start the PKI Platform 8 maintenance at 22:00 MDT (04:00 UTC). Then, for approximately 30 minutes, the PKI Platform 8 will experience service delays and performance degradation that affect:
- Signing in and using your PKI Platform 8 to perform in-console certificate lifecycle tasks.
- Using any of your PKI Platform 8 corresponding APIs or protocols (for example, SOAP, REST, SCEP, and EST) to perform certificate lifecycle operations.
- Performing certificate lifecycle tasks/operations:
- Enrolling certificates: new, renew, or reissues
- Adding domains and organizations
- Submitting validation requests
- Viewing reports, revoking certificates, and creating profiles
- Adding users, viewing certificates, and downloading certificates
- Certificate issuance for PKI Platform 8 and its corresponding API.
Additionally:
- APIs will return a "cannot connect" error.
- Certificate enrollments that receive "cannot connect" errors must be resubmitted after DigiCert restores services.
The PKI Platform 8 maintenance only affects PKI Platform 8. It does not affect any other DigiCert platforms or services.
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
October 2, 2021
Upcoming Schedule Maintenance
On October 2, 2021, between 22:00 – 24:00 MDT (October 3, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.
CertCentral, CIS, SCEP, Direct Cert Portal, and DigiCert ONE maintenance
DigiCert will perform scheduled maintenance. Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
PKI Platform 8 maintenance and downtime:
DigiCert will perform scheduled maintenance on PKI Platform 8. During this time, the PKI Platform 8 and its corresponding APIs will be down for approximately 20 minutes.
We will start the PKI Platform 8 maintenance at 22:00 MDT (04:00 UTC).
Then, for approximately 20 minutes:
- You will be unable to sign in and use your PKI Platform 8 to perform in-console certificate lifecycle tasks.
- You will be unable to use any of your PKI Platform 8 corresponding APIs or protocols (for example, SOAP, REST, SCEP, and EST) to perform certificate lifecycle operations.
- You will be unable to:
- Enroll certificates: new, renew, or reissues
- Add domains and organizations
- Submit validation requests
- View reports, revoke certificates, and create profiles
- Add users, view certificates, and download certificates
- DigiCert will be unable to issue certificates for PKI Platform 8 and its corresponding API.
- APIs will return a "cannot connect" error.
- Certificate enrollments that receive "cannot connect" errors must be resubmitted after DigiCert restores services.
The PKI Platform 8 maintenance only affects PKI Platform 8. It does not affect any other DigiCert platforms or services.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
September 11, 2021
Upcoming Schedule Maintenance
On September 11, 2021, between 22:00 – 24:00 MDT (September 12, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.
CertCentral, CIS, SCEP, Direct Cert Portal, and DigiCert ONE maintenance
DigiCert will perform scheduled maintenance. Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
PKI Platform 8 maintenance and downtime:
DigiCert will perform scheduled maintenance on PKI Platform 8. During this time, the PKI Platform 8 and its corresponding APIs will be down for approximately 60 minutes.
We will start the PKI Platform 8 maintenance at 22:00 MDT (04:00 UTC).
Then, for approximately 60 minutes:
- You will be unable to sign in and use your PKI Platform 8 to perform in-console certificate lifecycle tasks.
- You will be unable to use any of your PKI Platform 8 corresponding APIs or protocols (for example, SOAP, REST, SCEP, and EST) to perform certificate lifecycle operations.
- You will be unable to:
- Enroll certificates: new, renew, or reissues
- Add domains and organizations
- Submit validation requests
- View reports, revoke certificates, and create profiles
- Add users, view certificates, and download certificates
- DigiCert will be unable to issue certificates for PKI Platform 8 and its corresponding API.
- APIs will return a "cannot connect" error.
- Certificate enrollments that receive "cannot connect" errors must be resubmitted after DigiCert restores services.
The PKI Platform 8 maintenance only affects PKI Platform 8. It does not affect any other DigiCert platforms or services.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance begins and when it ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete our maintenance.
September 7, 2021
CertCentral Services API: Get orders by alternative order ID
We created a new endpoint to make it easier to get certificate order details using alternative order IDs: Get orders by alternative order ID. This endpoint returns the order ID, certificate ID, and order status of certificate orders with the alternative_order_id you provide in the URL path.
July 12, 2021
Verified Mark Certificates available now.
Verified Mark Certificates (VMCs) are a new type of certificate that allow companies to place a certified brand logo next to the “sender” field in customer inboxes—visible before the message is opened—acting as confirmation of your domain’s DMARC status and your organization’s authenticated identity. Learn more about VMC certificates.
To disable or change availability of VMC in your account, visit the Product Settings page.
Note: If you do not see VMCs in your account, it may be because we are not offering the product to all account types yet. It is also possible that the product is available, but one of your CertCentral account’s administrators turned the product off in Product Settings.
CertCentral Services API: Verified Mark Certificate enhancements
To help you manage your Verified Mark Certificate (VMC) orders in your API integrations, we’ve made the following updates to the CertCentral Services API.
New endpoints:
- Order Verified Mark Certificate
We added a new endpoint—Order Verified Mark Certificate—you can use to create or renew a VMC order. - Update VMC order
We added a new endpoint—Update VMC order—you can use to update the trademark country code or registration number for a pending VMC order. - Validate VMC logo format (SVG or encoded)
We added two new endpoints—Validate logo format (SVG) and Validate logo format (encoded)—you can use to check if the format of an SVG file is compatible with the requirements for VMC. - Upload VMC logo (SVG or encoded)
We added two new endpoints—Upload VMC logo (SVG) and Upload VMC logo (encoded)—you can use to upload a logo for a pending VMC order. - Get VMC logo
We added a new endpoint—Get VMC logo—you can use to download the logo for a VMC order.
Updated endpoints:
- Order info
We updated the Order info endpoint to return a vmc object with the trademark country code, registration number, and logo information for VMC orders. - Email certificate
We updated the Email certificate endpoint to support emailing a copy of your issued VMC.
To learn more about managing VMC certificates from your API integrations, visit Verified Mark Certificate workflow.
July 10, 2021
Upcoming schedule maintenance
On July 10, 2021, between 22:00 – 24:00 MDT (July 11, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.
During maintenance, for approximately 60 minutes, the services specified below under Service downtime will be down. Due to the scope of the maintenance, the services specified below under Service interruptions may experience brief interruptions during a 10-minute window.
Service downtime
From 22:00 – 23:00 MDT (04:00 – 05:00 UTC), while we perform database-related maintenance, the following services will be down for up to 60 minutes:
- CertCentral / Services API
- Direct Cert Portal / API
- ACME
- Discovery / API
- ACME agent automation / API
API Note: Affected APIs will return “cannot connect” errors. Certificate-related API requests that return a “cannot connect” error message during this window will need to be placed again after services are restored.
Service interruptions
During a 10-minute window, while we perform infrastructure maintenance, the following DigiCert service may experience brief service interruptions:
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- DigiCert ONE
- Automation service
- CT Log monitoring
- Vulnerability assessment
- PCI compliance scans
Services not affected
These services are not affected by the maintenance activities:
- PKI Platform 8
- PKI Platform 7
- QuoVadis TrustLink
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance starts and when maintenance ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as the maintenance is completed.
June 5, 2021
Upcoming scheduled maintenance
On June 5, 2021, between 22:00 – 24:00 MDT (June 6, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance. Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance starts and when maintenance ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
June 3, 2021
CertCentral Services API: Improved domains array in OV/EV order response
To make it easier to see how the Services API groups the domains on your OV/EV TLS certificate orders for validation, we added a new response parameter to the endpoints for submitting certificate order requests: domains[].dns_name.*
The dns_name parameter returns the common name or SAN of the domain on the order. To prove you control this domain, you must have an active validation for the domain associated with the domains[].name and domains[].id key/value pairs.
Example OV certificate order
JSON payload:
JSON response:
The Services API returns the domains[].dns_name parameter in the JSON response for the following endpoints:
- Order SSL (type_hint)*
- Order OV/EV SSL
- Order Secure Site SSL
- Order Basic OV
- Order Basic EV
- Order Secure Site OV
- Order Secure Site EV
- Order Secure Site Pro SSL
- Order Secure Site Pro EV SSL
- Order Multi-year Plan*
*Note: Only order requests for OV/EV TLS certificates return a domains array.
May 1, 2021
Upcoming scheduled maintenance
On May 1, 2021, between 22:00 – 24:00 MDT (May 2, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.
For up to 10 minutes total during the 2-hour window, we will be unable to issue certificates for the DigiCert platforms, their corresponding APIs, immediate certificate issuance, and those using the APIs for other automated tasks.
Affected services:
- CertCentral / Service API
- ACME
- ACME agent automation / API
- Direct Cert Portal / API
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- QuoVadis TrustLink
Services not affected
- PKI Platform 8
- PKI Platform 7
- DigiCert ONE managers
API note:
- APIs will return "cannot connect" errors.
- Certificate requests submitted during this window that receive a "cannot connect" error message will need to be placed again after services are restored.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance starts and when maintenance ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
April 29, 2021
CertCentral Services API: Domain validation status in Domain info response
To make it easier to get a comprehensive validation status for your domains, DigiCert is deprecating the status parameter in the Domain info response. To ensure you are getting complete and accurate status information for each different validation type on your domains, you should use the validations array when you call the Domain info endpoint from your API integrations instead.
Note: The Domain info endpoint will continue to return a status parameter value.
Background
In the Domain info response, the status parameter is designed to return a single string value. When DigiCert offered fewer products, a single value in the API was enough to represent the validation status for your domains.
Now, DigiCert offers certificate products that use many different types of validation. Different validation types have different requirements, and these requirements change as industry standards evolve. As DigiCert validates your domains for different types of certificate issuance, each type of validation that you request can be in a different state.
For example:
- The OV validation for a domain may be completed.
- The EV validation for the same domain may be expired.
As a result, DigiCert can no longer use a single value to return comprehensive information about the validation status for a domain.
Instead of relying on a single value, use the Domain info endpoint to request a validations array – a list of objects with status information for each type of validation on the domain. To get this data, include the query parameter include_validation=true when you submit your request.
For example:
April 28, 2021
CertCentral Services API: Site seal enhancements
To help you manage your site seals in your API integrations, we’ve made the following updates to the CertCentral Services API:
- New endpoint: Upload site seal logo
We added a new endpoint – Upload site seal logo – you can use to upload your company logo for use with a DigiCert Smart Seal. This logo appears in the site seal on your website. Note: Only Secure Site and Secure Site Pro SSL/TLS certificates support the option to display your company logo in the site seal. - New endpoint: Update site seal settings
We added a new endpoint – Update site seal settings – you can use to change the appearance of your site seal and the information that displays on the site seal information page. - Updated endpoint: Get site seal settings
We updated the Site seal settings endpoint to return information about each property you can customize with the Update site seal settings endpoint.
Related topics:
April 26, 2021
CertCentral Services API: Revoke certificate by serial number
To make it easier to manage certificates from your API integrations, we updated the Revoke certificate endpoint path to accept the certificate ID or the serial number of the certificate to revoke. Previously, the Revoke certificate endpoint path only accepted the certificate ID.
Example Revoke certificate path using the certificate ID:
https://www.digicert.com/services/v2/certificate/{{certificate_id}}/revoke
Example Revoke certificate path using the certificate serial number:
https://www.digicert.com/services/v2/certificate/{{serial_number}}/revoke
April 3, 2021
Upcoming scheduled maintenance
On April 3, 2021, between 22:00 – 24:00 MDT (April 4, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.
During maintenance, for up to 10 minutes, we will be unable to issue certificates for the DigiCert platforms, their corresponding APIs, immediate certificate issuance, and those using the APIs for other automated tasks.
Affected services
For approximately 10 minutes, DigiCert will be unable to issue certificates for these services and APIs:
- CertCentral / Service API
- ACME
- ACME agent automation / API
- Direct Cert Portal / API
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- QuoVadis TrustLink
Services not affected
These services are not affected by the maintenance activities:
- PKI Platform 8 / API
- PKI Platform 8 SCEP
- PKI Platform 7 / API
- PKI Platform 7 SCEP
- DigiCert ONE managers
API note:
- APIs will return "cannot connect" errors.
- Certificate requests submitted during this window that receive a "cannot connect" error message will need to be placed again after services are restored.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues before or after the maintenance window.
- Expect interruptions if you use the APIs for immediate certificate issuance and automated tasks.
- To get live maintenance updates, subscribe to the DigiCert Status page. This subscription includes email alerts for when maintenance starts and when maintenance ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as we complete the maintenance.
March 17, 2021
CertCentral: New purchase order and invoice system
We are happy to announce that we are using a new purchase order and invoice system in CertCentral. We've made several changes to make it easier for you to manage your purchase orders and invoices.
The next time you sign in to CertCentral, you will see two new menu options under Finances: Pay Invoice and Purchase Orders and Invoices. Additionally, we now send all invoice emails from our new invoice system.
Pay invoices page
When you open the Pay invoice page, all invoices are preselected by default. You can choose to pay them all or select those you want to pay.
Note: If you use divisions with separate funds, when you open the Pay invoice page, all invoices for the top-level division are selected by default. Use the For dropdown to view the unpaid invoices by division in your account.
Purchase orders and invoices page
On the new Purchase orders and invoices page, you can create a purchase order (PO). In the Purchaseorders table, you can view pending and rejected POs. After we approve a PO, it becomes an invoice and moves to the Invoices table.
Note: If you use divisions with separate funds, you see the Purchase order and invoice summary page. When you click a division name, it opens the Purchase order and invoices page, where you can view the POs and invoices for that division.
In the Invoices column of the Invoices table, you can see the invoice number and the PO from which we generated it. You can download a copy of the invoice or pay the invoice. When you click Pay invoice, we take you to the Pay invoice page to pay the invoice and make the funds available in your account.
Existing PO and Invoice migration
- Autogenerated invoices
When we migrated our billing system, we did not migrate your autogenerated invoices. At the end of March, we will autogenerate a new invoice for your total amount owed. However, you can make a payment on your account at any time on the Deposit Funds page (in the left main menu, go to Finances > Deposit Funds). - Invoices generated from approved purchase orders
When we migrated your invoices to the new system, we gave them new invoice numbers. However, the associated purchase order number remains the same. If you have questions or trouble finding an invoice, please contact your account manager or DigiCert Accounts Receivable. Make sure to include your PO number and the original invoice number in the email.
CertCentral Services API: View balance enhancements
To help you track financial data in your API integrations, we updated the View balance endpoint to return the following data:
unpaid_invoice_balance
Unpaid invoice balancenegative_balance_limit
Amount the balance can go into the negativeused_credit_from_other_containers
Amount owed by other divisions in the account (for accounts with separate division funds enabled)total_available_funds
Total funds available for future purchases
Example response:
For more information, see the documentation for the View balance endpoint.
March 12, 2021
CertCentral Services API: Auto-reissue support for Multi-year Plans
We are happy to announce that the CertCentral Services API now supports automatic certificate reissue requests (auto-reissue) for Multi-year Plans. The auto-reissue feature makes it easier to maintain SSL/TLS coverage on your Multi-year Plans.
You can enable auto-reissue for individual orders in your CertCentral account. When auto-reissue is enabled, we automatically create and submit a certificate reissue request 30 days before the most recently issued certificate on the order expires.
Enable auto-reissue for a new order
To give you control over the auto-reissue setting for new Multi-year Plans, we added a new request parameter to the endpoints for ordering DV, OV, and EV TLS/SSL certificates: auto_reissue.
By default, auto-reissue is disabled for all orders. To enable auto-reissue when you request a new Multi-year Plan, set the value of the auto_reissue parameter to 1 in the body of your request.
Example request body:
Note: In new order requests, we ignore the auto_reissue parameter if:
- The product does not support Multi-year Plans.
- Multi-year Plans are disabled for the account.
Update auto-reissue setting for existing orders
To give you control over the auto-reissue setting for existing Multi-year Plans, we added a new endpoint: Update auto-reissue settings. Use this endpoint to enable or disable the auto-reissue setting for an order.
Get auto-reissue setting for an existing order
To help you track the auto-reissue setting for existing certificate orders, we added a new response parameter to the Order info endpoint: auto_reissue. The auto_reissue parameter returns the current auto-reissue setting for the order.
ICA certificate chain selection for public DV flex certificates
We are happy to announce that select public DV certificates now support Intermediate CA certificate chain selection:
- GeoTrust DV SSL
- Thawte SSL 123 DV
- RapidSSL Standard DV
- RapidSSL Wildcard DV
- Encryption Everywhere DV
You can add a feature to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues the end-entity certificate when you order these public DV products.
This feature allows you to:
- Set the default ICA certificate chain for each supported public DV certificate.
- Control which ICA certificate chains certificate requestors can use to issue their DV certificate.
Configure ICA certificate chain selection
To enable ICA selection for your account:
- Contact your account manager or our Support team.
- Then, in your CertCentral account, in the left main menu, go to Settings > Product Settings.
- On the Product Settings page, configure the default and allowed intermediates for each supported and available DV certificate.
For more information and step-by-step instructions, see the Configure the ICA certificate chain feature for your public TLS certificates.
DigiCert Services API: DV certificate support for ICA certificate chain selection
In the DigiCert Services API, we made the following updates to support ICA selection in your DV certificate order requests:
- Updated the Product list endpoint
After adding the ICA certificate selection chain feature to your account, the Product list endpoint returns each ICA certificate's name and ID available to issue end-entity certificates for the supported DV products (see allowed_ca_certs). - Updated the Product limits endpoint
After you configure the allowed and default ICA certificates for a DV product, the Product limits endpoint returns the default issuing ICA (default_intermediate) and allowed issuing ICAs (allowed_intermediates) that certificate requestor with a given container and user role assignment can select. - Updated the Product info endpoint
The Product list endpoint now returns the name, ID, and certificate chain information for the issuing ICAs you can select when you request a given product (see allowed_ca_certs). - Added support for ICA chain selection to these DV certificate order requests:
Pass in the issuing ICA certificate's ID as the value for the ca_cert_id parameter in your order request's body.
Example DV certificate request:
For more information about using ICA selection in your API integrations, see DV certificate lifecycle – Optional ICA selection.
March 6, 2021
Upcoming scheduled maintenance
On March 6, 2021, between 22:00 – 24:00 MST (March 7, 2021, between 05:00 – 07:00 UTC), DigiCert will perform scheduled maintenance.
Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.
What can you do?
Please plan accordingly.
- Schedule your high-priority orders, renewals, and reissues around the maintenance window.
- To get live maintenance updates, subscribe to the DigiCert Status page. The subscription includes emails to let you know when maintenance starts and ends.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as the maintenance is completed.
February 19, 2021
CertCentral Services API: New subaccount endpoints
To make it easier to manage your subaccounts, we added two new endpoints to the CertCentral Services API: List subaccount domains and List subaccount organizations.
- List subaccount domains – Use this endpoint to get information about the domains in a subaccount.
- List subaccount organizations – Use this endpoint to get information about the organizations in a subaccount.
February 17, 2021
CertCentral Services API: Improved Create subaccount endpoint
To give you more control over your subaccounts, we added two new request parameters to the Create subaccount endpoint: child_name and max_allowed_multi_year_plan_length.
child_name– Use this parameter to set a custom display name for the subaccount.max_allowed_multi_year_plan_length– Use this parameter to customize the maximum length of Multi-year Plan orders for the subaccount.
Example JSON request:
After creating a subaccount, use the Subaccount info endpoint to view a subaccount's "display" name and allowed Multi-year Plan order length.
February 6, 2021
Upcoming scheduled maintenance
On February 6, 2021 between 22:00 – 24:00 MST (February 7, 2021 between 05:00 – 07:00 UTC), DigiCert will perform critical maintenance.
During maintenance, the services listed below will be down approximately 60 minutes. However, due to the scope work happening, there may be additional service interruptions during the two-hour maintenance window.
You will be unable to sign in to these platforms and access these services and APIs:
- CertCentral / Service API
- Direct Cert Portal / Direct Cert Portal API
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- Discovery / API
- ACME
- ACME agent automation / API
DigiCert will be unable to issue certificates for these services and APIs:
- CertCentral / Services API
- Direct Cert Portal / Direct Cert Portal API
- Certificate Issuing Service (CIS)
- Simple Certificate Enrollment Protocol (SCEP)
- Complete Website Security (CWS) / API
- Managed PKI for SSL (MSSL) / API
- QV Trust Link
These services will not be affected by the maintenance activities:
- PKI Platform 8
- PKI Platform 7
- DigiCert ONE managers
API note:
- Services to process certificate-related transactions will be unavailable, such as, requesting certificates, adding domains, and validation requests.
- APIs will return “cannot connect” errors.
- Certificate requests placed during this window that receive a "cannot connect" error message will need to be placed again after services are restored.
What can I do?
Plan accordingly:
- Schedule high-priority orders, renewals, and reissues around the maintenance window.
- Expect interruptions if you use APIs for immediate certificate issuance and automated tasks.
- Subscribe to the DigiCert Status page to get live updates, .
- See the DigiCert 2021 scheduled maintenance for scheduled maintenance dates and times.
Services will be restored as soon as the maintenance is completed.
January 25, 2021
CertCentral Services API: Improved Domain emails endpoint
To make it easier to find the DNS TXT email addresses that receive validation emails from DigiCert for email-based domain control validation (DCV), we added a new response parameter to the Domain emails endpoint: dns_txt_emails.
The dns_txt_emails parameter returns a list of email addresses found in the DNS TXT record for the domain. These are the email addresses we find in the DNS TXT record on the _validation-contactemail subdomain of the domain being validated.
Example response with new parameter:
To learn more about the newly supported email to DNS TXT contact DCV method:
For information about validating the domains on DV certificate orders:
For information about validating the domains on OV/EV certificate orders:
January 20, 2021
CertCentral Services API: New Unit order details and Cancel unit order endpoints
We are happy to announce we added two new endpoints to the CertCentral Services API: Unit order details and Cancel unit order.
These endpoints allow you to get information about a unit order and to cancel a unit order.
Canceling unit orders:
- You can only cancel an order within thirty days of placing it.
- You cannot cancel a unit order if the subaccount on the order has spent any of the units.
If you manage a subaccount that uses units as its payment method, you can now use the Services API to do the following tasks:
CertCentral Services API: Improved Product list, Product limits, and Product info endpoints
To make it easier to find the available order validity periods for the digital certificate products in your account, we added new response parameters to the Product list, Product limits, and Product info endpoints.
These new response parameters allow you to view the default and customized order validity limits for each product in your account.
The allowed_order_validity_years parameter returns a list of the supported order validity periods for each product in your account.
The allowed_order_lifetimes parameter returns a list of the customized order validity limits for users with different division and user role assignments in your account.
- The
allowed_order_validity_yearsparameter returns a list of the order validity periods that are available when you request the certificate product. - The
custom_order_expiration_date_allowedparameter returns a boolean value that describes whether you can set a custom order expiration date when you request the certificate product.
CertCentral Services API: Improved Subaccount order info endpoint
To make it easier to find information about the validity periods for subaccount orders, we added new response parameters to the Subaccount order info endpoint. These new response parameters allow you to see the order start date, the order end date, and whether the order is a Multi-year Plan.
- The
is_multi_year_planparameter returns"1"if the order is a Multi-year Plan. - The
order_valid_fromparameter returns the start date of the order validity period. - The
order_valid_tillparameter returns the end date of the order validity period.
Example response with new parameters
January 9, 2021
Upcoming scheduled maintenance
On January 9, 2021 between 22:00 – 24:00 MST (January 10, 2021 between 05:00 – 07:00 UTC), DigiCert will perform scheduled maintenance.
Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.
What can you do?
Please plan accordingly.
- Schedule high-priority orders, renewals, reissues, and duplicate issues outside of the maintenance window.
- To get live updates, subscribe to the DigiCert Status page.
- For scheduled maintenance dates and times, see DigiCert 2021 scheduled maintenance.
Services will be restored as soon as maintenance is completed.
December 22, 2020
CertCentral Services API: Update renewal notification settings
We added a new endpoint to the CertCentral Services API contract: Update renewal notification settings. Use this endpoint to enable or disable renewal notifications for a certificate order.
For more information, visit the reference topic for this endpoint in the Services API documentation:
December 17, 2020
Customize the lifetime of your DigiCert Multi-year Plan
We are happy to announce you can now configure a custom lifetime for your Multi-year Plan (MyP) when requesting a TLS certificate in CertCentral. On the TLS certificate request forms, use the new Custom order validity option to customize the length of your TLS certificate order.
Note: Maximum TLS certificate validity is 397 days per industry best practices. See End of 2-Year public SSL/TLS certificates.
Custom Multi-year Plan order lengths can be set in days or by expiration date. Maximum order length is 2190 days (6 years). Minimum order length is 7 days.
Note: Custom orders start on the day we issue the certificate for the order. Order pricing is prorated to match the certificate selected and your custom order length.
To customize your MyP coverage
- On the Request certificate form, click Select coverage length.
- In the How long do you need to protect your site pop-up window, select Custom order validity.
- Under Select your customer order length, configure the lifetime for your Multi-year Plan:
- Custom order length
Specify the length of your plan in days. - Custom order expiration date
Select the day you want your plan to expire on.
- Custom order length
- Click Save.
Updated product settings for public TLS certificates
To provide more control over your certificate order process, we updated the product settings for public TLS certificates. Now, you can determine the allowed Multi-year Plan order lengths users can select from when ordering a public TLS certificate.
On the TLS certificate's product settings page, use the Allowed validity periods option to determine what MyP order lengths appear on a TLS certificate request form: 1 Year, 2 Years, 3 Years, 4 Years, 5 Years, and 6 Years. Note that changes made to product settings apply to requests placed through CertCentral and the Services API.
Note: Previously, the Allowed validity periods option was used to determine the maximum certificate lifetime a user could select when ordering a public TLS certificate. However, with the industry move to 1-year certificate this option is no longer needed for certificate lengths. See End of 2-Year public SSL/TLS certificates.
To configure the allowed MyP order lengths for a TLS certificate
- In the left main menu, go to Settings > Product Settings.
- On the Product Settings page, select a public TLS certificate. For example, select Secure Site OV.
- Under Secure Site OV, in the Allowed validity periods dropdown, select the validity periods.
- Click Save Settings.
The next time a user orders a Secure Site OV certificate, they will only see the validity period lengths you selected on the request form.
Note: Setting limits on Multi-year Plan order lengths removes the custom validity option from your TLS certificate request forms.
CertCentral Domains page: Improved domains.csv report
On the Domains page, we improved the CSV report to make it easier to track OV and EV domain validation expiration dates and to view the previously used domain control validation (DCV) method.
The next time you download the CSV file, you will see we three new columns in the report:
- OV Expiration
- EV Expiration
- DCV Method
To download the domains.csv report
- In the left main menu, go to Certificates > Domains.
- On the Domains page, in the Download CSV dropdown, select Download All Records.
When you open the domains.csv, you should see the new columns and information in your report.
December 3, 2020
CertCentral Orders page: Improved load times
In CertCentral, we updated the Orders page to improve load times for those managing high volumes of certificate orders. The next time you visit the Orders page, it will open much quicker (in the left main menu go to Certificates > Orders).
To improve load times, we changed the way we filter your certificate orders upon initial page view. Previously, we filtered the page to show only Active certificate orders. However, this was problematic for those with high volumes of certificate orders. The more orders you have in your account, the longer the Orders page took to open.
Now, when you visit the page, we return all your certificates, unfiltered, in descending order with the most recently created certificate orders appearing first in the list. To see only your active certificates, in the Status dropdown, select Active and click Go.
CertCentral Services API: Purchase units for subaccounts and view unit orders
In the CertCentral Services API, we've added new endpoints for purchasing units and viewing unit orders. Now, if you manage subaccounts that use units as the payment method for certificate requests, you can use the Services API to buy more units for a subaccount and to get information about your unit order history.
For more information, see the reference documentation for the new endpoints:
December 2, 2020
CertCentral Services API: Documentation updates
We're pleased to announce the following updates to the documentation for the CertCentral Services API:
- New Voucher price estimate API
We published a new reference topic for the Voucher price estimate endpoint. Customers who use vouchers can use this endpoint to estimate the cost (including tax) of an order for specific voucher configurations. - Updated API Glossary
We updated the Glossary with a new table to define the different organization validation status values. See Glossary – Organization validation statuses. - Added request parameter to Update account emails documentation
We added theemergency_emailsrequest parameter to the documentation for the Update account emails endpoint. Use this parameter to update the email addresses that receive emergency notifications from DigiCert.
Example Update account emails request body:
- Added response parameters to the Product info documentation
We added thevalidation_type,allowed_ca_certs, anddefault_intermediateresponse parameters to the documentation for the Product info endpoint.- Use the
validation_typeparameter to get the validation type for a given product. - Use the
allowed_ca_certsparameter to get information about the ICA certificates you can select when you order a given product. * - Use the
default_intermediateparameter to get the ID of the default ICA for a given product. *
- Use the
Example Product info response data:
* Note: The Product info endpoint only returns the allowed_ca_certs and default_intermediates parameters for products that support ICA selection. For public SSL certificates that support ICA selection (OV and EV flex certificates), these parameters are only returned if ICA selection is enabled for the account. Additionally, the default_intermediates parameter is only returned if an administrator has customized a product setting for a division or user role in the account. For more information, see ICA certificate chain option for public OV and EV flex certificates.
November 3, 2020
CertCentral Services API: Added DCV tokens for new domains to response data for OV and EV certificate orders
We've updated the endpoints for ordering public OV and EV SSL certificates to return the domain control validation (DCV) request tokens for new domains on the order.
Now, when you request an OV or EV certificate, you no longer have to issue separate requests to get the DCV request tokens for the new domains on the order. Instead, you can get the tokens directly from the response data for the order request.
Example response data:
Note: The dcv_token object is not returned for domains that will be validated under the scope of another domain on the order, for domains that already exist in your account, or for subdomains of existing domains.
This update applies to the following endpoints:
October 13, 2020
ICA certificate chain selection for public OV and EV flex certificates
We are happy to announce that public OV and EV certificates with flex capabilities now support Intermediate CA certificate chain selection.
You can add an option to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues your public OV and EV "flex" certificates.
This option allows you to:
- Set the default ICA certificate chain for each public OV and EV flex certificate.
- Control which ICA certificate chains certificate requestors can use to issue their flex certificate.
Configure ICA certificate chain selection
To enable ICA selection for your account, contact your account manager or our Support team. Then, in your CertCentral account, on the Product Settings page (in the left main menu, go to Settings > Product Settings), configure the default and allowed intermediates for each type of OV and EV flex certificate.
For more information and step-by-step instructions, see ICA certificate chain option for public OV and EV flex certificates.
DigiCert Services API support for ICA certificate chain selection
In the DigiCert Services API, we made the following updates to support ICA selection in your API integrations:
- Created new Product limits endpoint
Use this endpoint to get information about the limits and settings for the products enabled for each division in your account. This includes ID values for each product's default and allowed ICA certificate chains. - Added support for ICA selection to public TLS OV and EV flex certificate order requests
After you configure allowed intermediates for a product, you can select the ICA certificate chain that should issue your certificate when you use the API to submit an order request.
Pass in the ID of the issuing ICA certificate as the value for theca_cert_idparameter in the body of your order request
Example flex certificate request:
For more information about using ICA selection in your API integrations, see OV/EV certificate lifecycle – (Optional) ICA selection.
August 26, 2020
DigiCert® Multi-year Plans available for all DigiCert public SSL/TLS certificates
We are happy to announce that Multi-year Plans are now available for all public SSL/TLS certificates in CertCentral. These plans allow you to pay a single discounted price for up to six years of SSL/TLS certificate coverage.
Note: Enterprise License Agreement (ELA) contracts support only 1 and 2-year Multi-year Plans. Flat Fee contracts do not support Multi-year Plans. If you have a Flat Fee contract, please contact your account manager to find a solution that works with your contract.
With Multi-year Plans, you pick the SSL/TLS certificate, the duration of coverage you want (up to six years), and the certificate validity. Until the plan expires, you reissue your certificate at no cost each time it reaches the end of its validity period. For more information, see Multi-year Plans.
DigiCert Services API changes to support Multi-year Plans
In our Services API, we updated our public SSL/TLS certificate endpoints to support ordering a certificate with a Multi-year Plan.
To each endpoint for ordering a public SSL/TLS certificate, we added new optional* request parameters. Additionally, we've updated these endpoints such that the validity period of your order no longer must match the validity period of your certificate.
- New optional cert_validity parameter
Use this parameter to define the validity period of the first certificate issued for the order. If you omit the cert_validity parameter from your request, your certificate validity defaults to the maximum validity that DigiCert and industry standards allow, or the validity period of the order, whichever is sooner. - New optional order_validity parameter*
Use this parameter to define the validity period for the order. Order validity determines the length of a Multi-year Plan. - Updated top-level validity_years, validity_days, custom_expiration_date parameters*
For existing API integrations, you can still use these existing parameters to define the validity period of the order. However, we recommend updating your integrations to use the new parameters instead. Remember, with Multi-year Plans, your order can have a different validity period than your certificate.
*Note: Requests must include a value for either the order_validity object or for one of the top-level order validity parameters: validity_years, validity_days, or custom_expiration_date. The values provided in the order_validity object override the top-level validity parameters.
These changes should not affect your current integrations. However, to maximize your SSL/TLS coverage, you may want to start purchasing your public SSL/TLS certificates with a Multi-year Plan. For API integrations, see Order Multi-year Plan.
Example certificate request with new parameters
